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INTRODUCTION 


PURPOSE 

The purpose ol this study was to determine the merits of propulsion system 
development testing utilizing the existing data base of technical reports and people 
and to organize and present available data along with conclusions and 
recommendations for use by management in the structuring of future vehicle 
development programs. 

SCOPE 

The study encompassed a review of all available test reports of propulsion 
system development testing for the Saturn stages, the Titan stages, and Space 
Shuttle main propulsion system. The knowledge on propulsion system 
development and system testing available from specialists and managers was also 
"tapped" for inclusion. The data from the numerous sources was analyzed and is 
included in the report along with conclusions and recommendations, program risk 
involved if propulsion system testing is not conducted, and a verification trade study 
to select a preferred verification alternative using the analytical hierarchy process 
(AHP). 

AUTHORITY 

This study was performed in response to a task from Stennis Space Center to 
contract NAS8-36700. 

DATA GATHERING PROCESS 

Static firings that were chosen as having applicability to this study went back 
approximately 30 years, consequently considerable time was spent locating data 
for screening. The MSFC Repository and Library, the Redstone Scientific 
Information Center, the MSFC Technical Information and Services Branch, the 
University of Alabama-Huntsville library, and a number of individual employees of 
NASA and the Saturn stage contractors were contacted for leads to Saturn data. 
Some documents were located in the personal files of individuals, however, it was 
found that the major part of the documents had either been destroyed or had been 
sent to the Federal Archives and Records Center in East Point. Georgia. Retrieval 
from that location proved to be quite lengthy and incomplete. To provide additional 
data, a survey form requesting data inputs was also distributed to 138 propulsion 
system specialists. 
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SUMMARY 


The importance of, and necessity for, propulsion system testing has been 
investigated to provide a data base and recommendations for assisting program 
managers who may be confronted with propulsion system testing decisions. 

Two complementing approaches have been used in the study 
implementation. First, a survey form and instructions distributed to 138 propulsion 
system/engine design and test experts throughout the nation requested information 
relative to propulsion system testing, and secondly, all NASA launch vehicles and 
some Air Force missile development programs since 1960 were evaluated relative 
to constructive contributions from propulsion system test programs. Significant 
findings from these activities, including conclusions and recommendations, are 
presented. 

Program managers and chief engineers, managers of major engineering 
organizations, and active design and test engineers experienced in both vehicle 
and engine development were included in the survey. In response to one major 
survey request, "Summarize your opinion of the role of "all-up" system testing in 
verification of a new propulsion system prior to first launch," response strongly 
supported/urged such testing with most considering such testing mandatory. Only 
one respondent was opposed to system testing. A few expressed qualifications 
related to manned versus unmanned vehicles and similarity of designs with 
previous designs. A series of other survey "choice type" questions permitted 
assessment of the relative importance of cost, schedule, and reliability. As was 
expected, reliability was easily the winner. 

Evaluation of previous vehicle development programs was accomplished by 
obtaining and reviewing static firing test reports from battleship, all systems vehicle, 
and in some cases, flight stages acceptance firings. Other data sources were used 
where noted test reports were not available. For S-IV, documentation was totally 
unavailable, thus personnel memory was the data source. Programs included in 
the evaluation were all stages of Saturn I (1959-1965), Saturn IB (1961-1968), 
Saturn V (1961-1972), and Space Shuttle from NASA’s reservoir and Titan ICBM, 
Gemini Titan, and Space Titan from the Air Force reservoir. These programs 
represent a wide spectrum of propulsion system hardware — single and multi tanks 
for each propellant, various propellant combinations including both cryogenic and 
storable, various engine designs including both single and clustered engine 
configurations, propulsion systems for booster stages, and space type vehicles with 
altitude ignition. 

Compared with today’s state of the art in rocket engine and stage design and 
testing, the technological base in the late 1950’s and early 1960's was lacking in 
many areas. As a result, the Saturn I, IB, and V programs, initiated at that time, 
experienced many problems that in hindsight could have been prevented. The 
Shuttle program and Air Force programs, initiated approximately 10 years later, 
benefited from these early mistakes. While some problems encountered on Shuttle 
and late Air Force programs were common with those of earlier programs, many 
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had not previously been experienced. Similarly, for any program initiated today, 
Shuttle experiences should be more valuable than prior program experiences. 
Thus in evaluating data within this report, experiences on Shuttle are emphasized 
since it represents later technologies. 

Included in the report are vehicle configuration descriptions, system operation 
descriptions, system test objectives, and test accomplishments. Accomplishments 
are presented based on an evaluation of flight or launch operation failure 
avoidance. Data is also included on hardware changeout frequency, hazardous 
leakage, fires, and safing procedures developed during testing. Lessons learned, 
test program cost considerations, test schedule requirements, and representative 
future test program requirements are discussed. 

Even though Space Shuttle development could capitalize on the data base 
created by previous programs and many management, design and test personnel 
involved in Shuttle had been involved in prior programs, Space Shuttle propulsion 
system testing identified, as reported herein, three discrepancies which could be 
catastrophic during flight and three during preflight operations. Also identified were 
5 additional discrepancies classified as unworkable which would be experienced 
in flight and 17 during preflight operations. Unworkable implies a mandatory 
change, although the consequence may not be catastrophic. Other less serious 
discrepancies were observed and numerous product improvement activities 
resulted from the program. The above tabulations are conservative inasmuch as 
most vehicle and engine hardware descriptions are excluded from the above 
tabulations and these discrepancies are numerous and serious as evident from a 
study of the included tabular data. A careful review of Space Shuttle 
discrepancies, cost data suggesting prevention of one vehicle loss or loss of one 
mission may exceed total test program cost, and test schedule data suggesting 
serious program delays without propulsion system testing removes all doubts 
relative to the program benefits of propulsion system testing. This deduction is 
further emphasized by reviewing the risks associated with individual disciplines c* 
propulsion system design in the absence of a supporting propulsion system test 
program. Risks for potential launch delay are high for most disciplines, and risks 
for catastrophic flight failure and mission loss are high for a number of disciplines. 

Discrepancies in operational procedures, inadequacies in the vehicle 
propulsion systems and hardware, and inadequacies in engine hardware were 
also numerous for NASA programs prior to Shuttle. Air Force programs 
experienced difficulties also; however, available information on Air Force programs 
is incomplete, thus its usefulness relative to the current study is limited. 
Problems/discrepancies encountered in the earlier NASA programs involved most 
disciplines. For example, on Saturn I (the clustered tank and engine configuration) 
the flexible heat shield about the four gimballed engines failed structurally in the 
severe thermal, acoustic, and dynamic environment, thus requiring extensive 
development prior to flight. On Saturn V S-IC vehicle, helium bottle retainer nuts in 
the liquid oxygen tank became loose during firing. Also, the terminal countdown 
sequence was found to be flawed, thus output of all commands occurred at one 
time when a malfunction or loss of power supply occurred. On the Saturn V S-ll 
stage numerous switch failures occurred, thus soldered seals were abandoned for 
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welded seals. Also liquid oxygen tank fill-and-drain valves failed to actuate on 
command and particulate contamination resulted in unacceptable leakage. On 
Saturn V S-IVB stage, whose initial start occurred at altitude approximately eleven 
minutes after liftoff with second start in earth orbit several hours after first burn 
completion, data was collected relative to engine and feed system "warm up" 
characteristics after first burn and chilldown characteristics prior to second start. 
This type information and representative analytical techniques were vital for orbital 
engine start. A thorough review of these early vehicle propulsion system test 
findings support the earlier stated conclusion for Shuttle — propulsion system 
testing provides significant benefits. A similar tabulation, as noted earlier for Space 
Shuttle, of numbers of problems having potential catastrophic effects, and features 
which were unworkable is impressive. 

Propulsion system testing is expensive, requires extensive time to properly 
plan and implement, and can conceivably delay initial flight vehicle launch. The 
test article cost can be affected by the extent of new technology utilization, vehicle 
complexity and the extent to which vehicle launch facility interface hardware is 
simulated. Cost data based on a number of programs indicated propulsion system 
testing activities which prevent loss of only one vehicle may be cost effective. 
Vehicle programs can differ in purpose, thus risks which programs can accept may 
vary significantly. Vehicle complexity may vary dependent upon flight mission and 
also the extent to which advanced technology concepts and hardware designs are 
used. These various aspects and others have been evaluated and are reported in 
appropriate text, conclusions, and recommendations. Man rated programs require 
the highest reliability and are most demanding of propulsion system test programs, 
while unmanned, expendable programs using state-of-the-art technology are the 
least demanding. 

Trade-offs relative to the method used to collect necessary propulsion system 
data also are possible. Programs with less demanding needs may forego the 
formal propulsion system test program for an expanded FRF plus analyses or an 
expanded FRF, flight test program and analyses. The engineering staff and 
program manager must realistically evaluate each situation giving proper 
consideration to parameters such as loss of life potential, cost, schedule, achranced 
technology involved, design similarity with other programs, test site capability, and 
other factors. The report text provides propulsion system testing requirement 
guidance to the maximum extent possible. 

Table 3-1 (appendix), for Space Shuttle, lists the hundreds of specific 
individual technical requirements for which test data was sought and obtained. 
While these many requirements are of utmost importance, the primary reason for 
testing is to identify unknowns, many of which result from the interactive 
environments of the many independently designed systems. Analytical models 
and personnel insiohts are incapable of a mature representation Qf all events- 
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NASA'S HISTORICAL VERIFICATION PROCESS 


The Saturn V vehicle's first launch on November 9, 1967, was almost perfect 
in spite of the fact that neither the S-IC stage nor the S-ll stage had been flight 
tested. The restart of the S-IVB stage, after a three hour orbital coast, was equally 
successful on the first attempt. 

Books have been and will continue to be written on the success of the Saturn 
launch vehicle. It is contended that never before nor since the Saturn program has 
a technical endeavor been so successful. There was not one Saturn mission 
failure, no goal was written off, and most of all, national pride flourished for a brief 
time, without grief over loss of life in flight. Table 1 lists Saturn launches and 
provides information on each. 

The Space Shuttle continues to provide a never before achieved flexibility in 
space operations. The reusable spacecraft offers a large cargo capacity and 
relatively mild launch environment. These characteristics enable earth orbit and 
outer space launch capability for a wide variety of payloads previously restricted 
due to weight, shape, or launch sensitivity. 

SATURN STAGES 

A very real, much overlooked reason for the tremendous Saturn success was 
extensive ground testing and retesting— including propulsion system testing. 
Stage static firings were conducted during early development, during late 
development, for flight verification, between test flights for anomaly resolution, and 
finally for checkout prior to each launch. 

Starting with the first clustered engine firing in March 1960, NASA's emphasis 
was on stage static firing or, in other words, propulsion system testing. NASA's 
approach was first to prove system concepts using heavy-weight tanks and non- 
flight components where necessary and then to perform development testing to 
refine the stage and procedures with flight components where possible or practical. 

Wet countdown demonstration tests (propellant loadings) were performed at 
the launch site. S-IB, S-IV, and S-IVB all-systems-test-stages were either never 
built or never fired; however, much development testing was actually accomplished 
during flight stage acceptance firings. Each stage flown was static fired or 
acceptance tested at least once prior to launch. 

The propulsion test verification process that evolved for Saturn consisted of: 

• Component development test program 

• Component qualification test program 

• Special subsystem testing 
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TABLE 1. LIST OF ALL SATURN LAUNCHES* 
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Extracted from the NASA History Series, "Sta to Saturn", Roger E. Bllsteln, 1980. (H-6.8/SL. 1 








• Propulsion system (stage) development testing 

• Stage acceptance firings 

• Vehicle flight test program 

• Additional stage static testing for continued development, for resolution of in- 
flight anomalies, and for increased reliability. 

Structural test stages, dynamic test stages, and dummy "facilities check" 
stages were fabricated and tested in addition to propulsion system test articles. 
The schedule permitted S-l and S-IB flight tests with dummy upper stages but this 
luxury was not available for the S-IC or S-ll stages. 

SPACE SHUTTLE MAIN PROPULSION SYSTEM 

NASA's Space Shuttle MPS testing program, although abbreviated, was 
comparable to the previous Saturn program. Three non-firing tests and twelve 
combination development/verification firings met planned pre-test objectives. The 
main propulsion test article (MPTA) was flight configuration with a few practical 
exceptions: 

• Non-flight external tank insulation. 

• Auxiliary power unit (APU) simulated by ground powered hydraulic system. 

• Shuttle avionics test set (SATS) instead of flight computers. 

• Truss type load bearing structure forward of the 1307 bulkhead. 

• Simulated payload bay purge into aft compartment. 

• Some non-flight GSE consoles (however, most GSE was intended to be flight 
fidelity). 

• Non-flight propellant loading configuration (emergency drains added to the 
external tank). 

• Non-flight ground umbilical disconnects 

Many MPS components were adapted from Saturn, and thus qualified for 
main propulsion test (MPT) use by similarity or a delta qualification when 
necessary. New design components were subjected to rigorous development and 
qualification testing prior to use on the test article. 

MPT static firings were not used to resolve inflight anomalies, in part because 
no serious anomalies occurred that were not understood. The first launch was 
April 12, 1981, and the last MPT firing was performed January 17, 1981. However, 
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propellant loading tests were performed with the MPTA after the flight program 
started. 

Other Development/Verifica tion Testing 

Management started questioning the use of checkout firings for stage 
acceptance late in the Saturn development program, thus no true acceptance firing 
was planned for the integrated Shuttle configuration. A short duration FRF concept 
finally evolved for new orbiters, a new launch facility, or after extensive down time. 
It was later seriously argued that this minimum test was unnecessary even after the 
FRF for Challenger (OV-099) resulted in detection of a gross hydrogen leak which 
could have been catastrophic under flight conditions (without purging). 

Extensive development testing was performed at KSC with the flight vehicle 
prior to the first launch to improve propellant loading procedures and to resolve 
other problems. Due to a thermal protection system (TPS) failure on the external 
tank and to the desire to increase onboard propellant mass, several unplanned 
propellant loading tests were conducted both with the MPTA and with the flight 
vehicle at KSC. 

In addition to MPT static firings, structural test articles were built and tested, 
approach and landing tests were performed, an all-up hydraulic simulator Flight 
Control Hydraulic Laboratory (FCHL) was developed and used, a mated vehicle 
ground vibration test (MVGVT) program was conducted, a Shuttle Avionics 
Integrated Laboratory (SAIL) was and is used, along with the Hydraulic Simulation 
Laboratory (HSL), for software verification prior to launch, and full scale external 
tank terminal drain tests were conducted. 
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EVALUATION OF PROPULSION SYSTEM TEST PROGRAMS 


An evaluation of propulsion system test programs which have been conducted 
previously are discussed in this section. The intent is consolidation and focusing of 
significant aspects of various programs which may be beneficial to future programs. 
Major emphasis is placed on the Space Shuttle program since it is currently 
operational; the design is a benefactor of prior programs, and it represents, as 
much as any program, current, state-of-the-art technology. Data is also presented 
for the Saturn program. Further information and data on each program are 
presented in the various appendices. 

SPACE SHUTTLE MAIN PROPULSION SYSTEM 

MPTA is the Space Shuttle propulsion system test article. The test program 
was conducted at NASA's test site in Mississippi, and the program involved NASA 
and Space Shuttle element contractors: (1) Rockwell International, Space Division 
(orbiter); (2) Rockwell International, Rocketdyne Division (main engine); (3) Martin 
Marrietta (external tank); (4) Rockwell International, Space Division (integration 
and test site operation). 

MPTA Test Schedule 

Figure 1 contains schedule data for the program. The planned program 
involved 12 hot firings, 1 propellant loading test, and 2 structural resonant survey 
tests. The 15 tests plus several attempted tests were completed before the initial 
Shuttle flight. This program would satisfy all identified requirements presented in 
Appendix 3 of this report. The schedule for testing established on October 10, 
1977, two months prior to test initiation, depicts 12 tests with the last test on 
December 14, 1978. Test initiation was as planned, but Test 12 was not completed 
until January 17, 1981— two years later than planned. Later planning schedules, 
one developed on April 20, 1979, and one developed February 11, 1980, were 
almost equally in error. The actual schedule indicates 4 tests were necessary to 
obtain necessary structural and propellant loading data and 20 hot firing attempts 
were necessary to achieve 12 successful tests. 

The actual schedule shows three intervals in which major modifications were 
necessary. These periods were for updating vehicle and engine hardware and to 
repair damaged hardware. The total time for these modification periods was 1 7 
months, approximately one half the actual time of the test program. 

The following section provides more information on the test program, although 
important observations are possible from Figure 1. These observations follow: 

• The approximate three-week interval between tests reflected in planning 
activities was correct. 
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FIGURE 1. MPT A TEST SCHEDULES 





• Complexity of the vehicle, facility, and the total operations necessitates 
recognition of test abort possibilities and inclusion for same in test activity 
planning. 

• Inclusion of time for major modification/repairs is necessary for realistic 
scheduling of test programs for complex vehide designs. 

• Vehicle maturity will not exist in any complex vehicle design, test hardware, or 
flight hardware until some minimal system testing is performed. 

MPTA Events Summary 

A summary of some significant events from the propulsion system test 
program are presented in Table 2; and for purpose of convenience, information on 
aborted tests and causes of aborted tests have been extracted from Table 2 and 
presented in Table 3. Also, for convenience major changes made during the three 
modification periods are shown in Table 4. 

The features of Table 2 may be considered as a measure of vehicle maturity 
or lack thereof. Table 2 lists all tests, identifies those which were aborted and why 
aborted, when aborted, those which experienced propellant leakage either 
internally or externally, those experiencing fires, those for which fire indicators were 
activated, those for which installed safety enhancement features of internal 
gaseous nitrogen purges (5,000 and/or 30,000 Scfm) and internal/external water 
systems were activated and other pertinent data. To assist in comprehending the 
material in Table 2, the following observations of a statistical nature are presented: 

• There were 20 hot firing attempts. 

• Two of the twenty attempts did not result in engine ignition. These failures are 
classified as vehicle failures. Tests 1-001 and 6-02, 

• Seven of the twenty attempts were hot firing test aborts. All seven were engine 
related. 

• Hot firing aborts were distributed throughout the 20 firing attempts, although 
frequency of occurrence decreased after tests 6-03. 

• Twenty-six terminal counts were required. Fourteen were required during the 
first six firing attempts. After test 5A, only one per test was required, although 
frequent, simple "work arounds" were required. 

• Hydrogen leakage within the aft compartment occurred on 12 tests. Two tests 
experienced high leaks— engine hardware failures— Et/orbiter 17-inci 
disconnect was a frequent but relatively moderate "leaker." 

• The emergency 5,000 SCFM (5K) nitrogen safing purge (ground test system) 
within the aft compartment was used for 1 1 tests to enhance safe operation. 
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Table 2. MPT A Testing Summary 
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Table 2. MPTA Testing Summary (Continued) 
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Table 2. MPT A Testing Summary (Continued) 
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Table 2. MPTA Testing Summary (Concluded) 
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Table 3. MPTA Test Abort Summary 


TEST 

NUMBER 

TEST 

TATE 

ACTUAL 

TEST 

DURATION 
(sec . ) 

PLANNED 

TEST 

DURATION 
(sec . ) 

ABORT 

SOURCE 

DISCUSSION, 
ABORT CAUSE 

1-001 

04/11/78 

0 

2.35 

SSME and 
vehicle 

Instrumentation failures. 
Redline violations. 

5 

06/12/79 

54 

520 

SSME 

Faulty engine pump 
accelerometers . 

6-1 

07/02/79 

19 

520 

SSME 

Engine main fuel valve 
cracked and vehicle 
structural damage 
resulted. External fire. 

6-2 

11/24/79 

0 

520 

Vehicle 

Aft compartment hazardous 
gas system faulty reading. 

6-3 

11/04/79 

10 

520 

SSME 

Excessive HPOTP secondary 
seal cavity pressure cut 
test. Engine steerhorn 
(H2 line) ruptured and 
engine went 02 rich. 

7-1 

02/01/80 

5 

562 

SSME 

HPOTP turbine discharge 
temperature spike cut test 

9-1 

04/16/80 

6 

591 

SSME 

High HP FTP turbine 
discharge temperature 
indication. 

10-1 

07/12/80 

106 

550 

SSME 

Engine H2 preburner burn 
through resulted in aft 
compartment fire. 

11-1 

11/03/80 

20 

581 

SSME 

High HP FTP discharge 
temperature cut test . 
Nozzle aft manifold failed 
structurally. 
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Table 4. Test Hardware Modification Definition 


MODIFICATION 

TIME INTERVAL 

PROGRAM 

DISCUSSION/ 

PERIOD 

POST TEST | 

DATE 

DRIVER 

CHANGE IDENTIFICATION 

"A" 


07/07/78 

to 

04/04/79 

SSME 

Engine pumps capable of 
RPL operation required. 

02 flow meter, HPOTP 
development, engine main 
02 valve vibration 
problems and SSME 2001 
fire complicated develop- 
ment, and extended testing 
delay. Stub to flight 
nozzle change. 

"B" 

6-1 

07/02/79 

to 

10/24/79 

! 

SSME 

Engine main fuel valve 
cracked. H2 expelled in 
large quantities but no 
internal fire. 
Investigation necessary 
plus repair of extensively 
damaged vehicle. 

"C" 

i 

10 

07/12/80 

to 

11/13/80 

SSME 

Compartment fire due to H2 
preburner burn through. 
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• Similarly, the emergency 30K purge was used on three tests. 

• Fires occurred for nine firings— one huge external fire, three major external fires 
with one also internal to the aft compartment. Eight of the nine fires resulted 
from engine discrepancies. 

• Four of the fires near the vehicle base were typical of main fuel valve leaks 
through the engine after shutdown. 

• The one aft compartment fire resulted in extensive hardware damage. 

• Two of the external fires produced significant damage to the vehicle and 
facility— particularly instrumentation. 

• Hydrogen gas responsible for the huge external fire originated within the aft 
compartment and raised compartment pressure sufficient for structural failure of 
the vehicle heat shield and aft structure. 

• Water was used external to the vehicle to suppress fires on eight tests. 

• Water was not used within the aft compartment to suppress the single internal 
fire. 

• Fire detection systems identified five fires. 

The above observations do not address aspects of technical design which 
must be verified but attempts to focus attention on the complexity of the total activity 
and the risk involved in propulsion system development and verification for space 
and military vehicles. While complexity is apparent from Table 2, it is further 
demonstrated by Table 5 which is selected action items developed after the MPTA 
initial propellant loading test and the attempted/accomplished first static firing. 
Similar actions were necessary for subsequent tests; however, action items 
numbers and consequences of issues/actions addressed began decreasing after 
several tests had been conducted. 

Risks involved in propulsion system development and verification is not 
represented completely by Table 2. Another important aspect is associated with 
specific technical requirements-the real objective of testing-to 
develop/demonstrate maturity, performance, and functional capability of the 
vehicle, facility, and QSE, and to demonstrate functional compatibility of the three 
elements. Detailed test requirements to accomplish these purposes are included 
in Appendix 3. This test requirement list contained approximately 25 percent fewer 
entries when initial testing commenced. These "add on” test requirements resulted 
from oversight, failure to understand functional aspects properly, and hardware 
changes. Testing identified oversights which could have serious consequences 
under differing circumstances later in the development program. Five examples 
follow: 
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Table 5 


Main Propulsion Test Program - Test Site Edited Action List - 
Post Propellant LoadingTest (12/21/77) 


ACTION REQUIRED 

Review LH2 high point feedline liquid level sensor operation during propellant load 
test and repair. Review the need for redundancy 

Correct channelization of LH 2 tank liquid level sensors (20% to 80% and 98% to 
100 %) 

Troubleshoot and isolate the noise problem associated with the EIU SATS 
interface which resulted in a SATS fail condition 

Determine the cause of tripped circuit breaker for LH 2 recirculation pump #2 
Determine cause for the LH 2 disconnect purge 

Determine requirements for a backup GHe injection system for the LOX antigeyser 
system operation 

Review the system requirements and re-activate MEC backup power 

Provide necessary engineering to connect the KSC hazardous gas detection 
system to the LH2 vent system 

Perform engineering to insulate the RTLS dump line 

Provide necessary analysis and engineering to correct the LH 2 high point bleed 
system 

Perform special cryogenic test of LOX and LH2 auxiliary dump valves using a 
solenoid actuated system as well as the existing pressure control actuation system 
and recommend system changes required to improve valve performance 

Review the need for changing the 1/8“ sample Hne on the bottom of the LH 2 tank 
to a 1/4“ or larger line to facifltate tank sampling and verification of purge 
procedures 

Provide a change to SATS software to preclude opening engine LOX or LH2 main 
valves with pressure in feed ducts to prevent potential spinning of engine 
flowmeters and low pressure pumps 

Review the need for MEC cooling during the approximate eight-hour period from 
set-up of pneumatic equipment until start of countdown operations 

Redesign LOX facility system to provide a safer operational approach to LOX off- 
loading under existing constraints for the LOX fffl and drain system 

Review and revise LH2 system purge procedures to effect a better and faster 
operational method of system inerting, both pre- and post-test 

Review the adequacy of the fire detection sensors in the vehicle aft compartment 

Determine the cause and corrective action for the LH2 prevalve dual indication on 
engine #2 
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Table 5 


Main Propulsion Test Program - Test Site Edited Action List 
(Continued) • Post Propellant LoadingTest (12/21/77) 


ITEM NO. I ACTION REQUIRED 


Review recent facility system valve failures and determine corrective action 

Perform a complete design review of SATS, IOPS, EIU, interconnecting cabling, 
and associated software 

Troubleshoot the lower vehicle LH2 ;apacitence probe to determine the cause of 
data loss 

Determine operational changes required to prevent LOX/LH2 ullage pressure 
overshoot during terminal count sequence 

Troubleshoot LOX antigeyser point level sensor measurements 

Verify that all shipping covers and blanking plates have been removed prior to 
static firing 

Evaluate drift in pressure measurements which occurred during propellant load 
test 

Data evaluation improvements are needed. Evaluate 

Automatic propellant replenish system requires modification prior to static firing 


Note: Twenty-eight of forty-eight included 
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TaDie 5 


Main Propulsion Test Program - Test Site Edited Action L.st 

(Continued) - Post Test 1-001 (04/1 1/78) 



UNO 


ACTION REQUIRED 


8 

9 

10 
1 1 
12 

13 

14 


Rftdiine Raviflw Team - Assess all redline parameters with respect to need and limits. 


Work with Interlocks Working Group 
instrumentation Calibration - Review the method presently used tor calibration of 


critical measurements with respect to accuracy and cryogenic effect 
interlocks S ATS/M EC - Review the current Sequence and Interlocks Document with 


the idea of eliminating as many as possible. Emphasis should be on eliminating those 
analog functions which can be verified visually through other recording and 
monitoring techniques. Also, determine those software changes required such that 
they can be coordinated and implemented rapidly 

Auto SeoupnrB Data Review - Concentrate on the evaluation of the terminal count 


sequence -540 seconds through T-0 to identify all auto sequence problems 
Rflview all Stat ic Firing Setup. Countdown, and Securing Procedures to determine 


the clarity of instructions, correct labeling of control panels, the inclusion of adequate 
waming/caution notes, complete/correct instructions for countdown roll-back and 
recycle operations. Pay particular attention to manual functions not in rollback 
sequence. Review format for clarity and sequential understanding. Review 
emergency procedures for setup and presentation for rapid referral when required. 

amino t H? Pknonnect Purge ICD values with respect to flow reduction and change 


hardware to accommodate 


notormino fix associated with LQX/LH2 tanks overpre ssure condition reported during 


test. 


I 

Pax/iow rfiHhork nmnodure with respect to ET pressurization to reduce number of tank 


pressure cycles. 


Rovtow LH2/LOX tank dew point and oaaaiaHtv requirements with respect to 

. u i ftUai u MAAAjftOAMi raMur than that rtaeiroH ( 


reducing the requirement to that which Is necessary rather than that desired. Review 
purge procedures. 

Rav/iow I ox f^hairiown Procedure to determine what can be done to chill down faster 


with 3,500 GPM orifice installed 


Review drop na n arranaement and size and change as required to accommodate the 


liquid air/nitrogen accumulated during the test. 

Review nmnerkwee/nians with respect to static firing turnaround in case of an abort 

t a a _ ! ; i «- — ■ 4 ulea 4 a IKa nev4 X hie C Kai llH 


prior to engine start to minimize work performed prior to the next test. This should 
include data review, barge turnaround, and retest activity. 

Review the potential increase in the LH2 tank pressure to off-load at an increased 
rate. 

Review the possibility of re-establsihing propellant topping when a hold or a rollback. 
Note: Fourteen of thirty-eight included 
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Taoie 5 Main Propulsion Test Program - Test Site Edited Action Lst 

(Continued) - Post Test 1-002 


ITEM NO ACTION REQUIRED 

1 Conduct a complete review of every redline measurement with respect to the sensor 
used, how it is transmitted and signal conditioned, how it is recorded, and the method 
of checkout end-to-end. Include in this review the upper and lower limits of each 
measurement. 

2 Prepare a plan for and complete the troubleshooting associated with SATS/EIU #2 
problem. 

3 Review the entire software verification program to determine whether or not it si 
complete. Identify shortcomings and method to correct. 

4 Re-evaluate the IH 2 manifold temperature measurement with respect to the probe 
used versus what is required to produce a valid reading. 

5 Investigate the problem of warm LOX and determine changes in loading procedure, 
hardware design, etc., in order to provide colder LOX at ET/Orbiter interface. 

6 Change OCP-M0005 to positively start the LH 2 recirculation pumps prior to 
termination of fast fill. 

7 Determine system changes, i.e., hardware/software required to prevent pre-pressure 
overshoot and vent valve cracking prior to the next static firing. 

8 Correct operator panel legends between Firex water console and fire detect console 
for compatibility in order to eliminate confusion when Firex water is required. Review 
all other panels for similar problems. 

9 Investigate the need for redundancy in the Free Hydrogen Bumoff temperature 
sensors and igniters to prevent potential oountdown delays. 


10 Determine whether or not the fire bail seen at test termination is normal and, if so, 
determine the changes necessary to minimize the effect such as adding a purge, 
leaving engine water on, etc. 

1 1 Establish a team of systems engineers to completely review afl Test Profile Tables. 

1 2 Review the instrumentation on the Orbiter feed system with respect to adequacy 
under dynamic conditions while firing and/or POGO pulsing. Incorporate resonance 
survey data into review. 

1 3 Perform measurement of ET forward support bolt to determine pre-load relaxation and 
determine whether retorquing is required. 

1 4 Review the response of the 98% point level sensor in both the LH 2 and LOX systems 
wit respect to lengthening the time constant for fast fill termination to enhance 
propellant loading time. 

1 5 Determine the hardware and software required to improve the 60KB system to 
provide all three SSME parameters simultaneously and alternate page selection from 
at least two users. 

1 6 Investigate the discoloration of the LH 2 GSE fl and drain flex line with respect to 

damage. Also, determine if additional heat protection is required in umbilical areas. 
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• Main fuel valve structural failure and associated release of large hydrogen 
quantities. Design/manufacturing methods were changed. 

• Fuel preburner burn through and associated release of combustion products. 
Design changes made. 

• Automated prevalve closure was impossible under some failure conditions. 
Manual closure was delayed under some failure conditions until prevalve 
benefits were seriously compromised — To +6.5 minutes before closure was 
possible. Control computer/engine controller software changes necessary. 

• Faulty procedure for unloading oxygen from ET/orbiter created severe pressure 
surges within facility hardware. 

• Necessity for and location of launch facility igniters to bum engine released raw 
hydrogen at engine start. KSC established requirements for the igniter system. 

Technical accomplishments from propulsion system development testing of 
Space Shuttle to satisfy the above stated general objectives and the specific 
technical requirements in Appendix 3 are presented and discussed in Appendix 3. 
Each accomplishment has been assigned to one of four classifications: (1) 
potentially catastrophic; (2) unworkable, thus unacceptable without change; (3) 
workable - modification needed and anticipated/planned; and (4) improvement of 
some type. Also, each accomplishment is assessed relative to the time of events, 
detection or likely occurrence — flight or preflight. Table 6 is a summary tabulation 
of accomplishment as classified. Twenty-eight accomplishments are classified to 
be catastrophic or unworkable, with three of six catastrophic events related to flight. 
Three of twenty-two unworkable events are also related to flight. Twenty-eight of 
the forty total events are preflight related. The three potential catastrophic events 
for flight occurrence are: (1) structural failure of the main engine steer horn and 
resultant dumping of large quantities of hydrogen in the vehicle base, (2) the 
marginal stability characteristics of the ET/Orbiter 17-inch oxygen quick disconnect 
valve, and (3) the oxygen low level cutoff system inadequacies. While catastrophic 
and unworkable preflight accomplishments may be viewed to be less serious; they, 
in fact, are equally serious, as vehicle launch cannot occur and extensive time and 
testing activity are necessary to satisfactorily resolve them. 

Table 6. Reported Propulsion System Testing Accomplishments Classified by 
Consequence and Time Phased — MPT A 


Stage 

Catastrophe 

Unworkable 

Works 

Exi 

ibte Mod. 
aeded 

Improvement 

afnKlI 


Prefllaht 

liiPlill 

Prefllaht 

Fliaht 

IdnUPml 

Fliaht 

Prefliaht 

Shuttle 

3 

3 

5 

1 7 

3 

6 

1 

2 

D 


The preceding discussion attempts to put in perspective the requirement for 
propulsion system testing, the magnitude of the task, and the complexity and 


27 




















associated risk in developing and verifying a propulsion system for space vehicles 
by using actual data from a modern day, current operational vehicle. Maturity is a 
prerequisite for a successful flight program, thus any new development/verification 
program may be expected to encounter similar experiences. Conclusions to assist 
in subsequent program developments are: 

• Propulsion system complexity precludes total dependency on analytical 
methods for establishing flight worthiness. 

• Propulsion system maturity results from rigorous system testing. 

• Rigorous testing involves significant numbers of system tests and long duration 
tests. 

• High risk to test vehicle/facility are associated with the testing. 

• Flight schedules established for programs without adequate propulsion system 
testing may be relatively meaningless. 

• Delay of propulsion system testing until vehicie/engine hardware achieve some 
minimal maturity may be beneficial for reducing risk, cost, and test time. Launch 
site hardware and software requirements must be properly considered. 

■ Propulsion system testing should be considered exceptionally high risk without 
inclusion of safety enhancement features. 

SATURN STAGES 

Space Shuttle used data developed during the Saturn Program for 
vehicie/facility design, manufacturing, and test operations to the maximum extent 
possible. The Saturn Program had many unique requirements, thus it is important 
to review Saturn propulsion system testing experiences to ensure that conclusions 
presented are complete and correct. 

Included in this section are all stages of Saturn I, Saturn 16, and Saturn V. 
More specifically the S-IV, and S-l stage of Saturn I. S-IVB and S-IB stages of 
Saturn IB and S-IVB, S-ll, and S-IC stages of Saturn V. Available data for these 
stages are less plentiful than for Space Shuttle, thus the assessment is less 
complete. 

Summary of Findings 

Table 7 contains tabular information about static firings for various stages 
developed. Information relative to stage and engine design for the various vehicles 
are included in Table 8. The time span for these test programs is from early 1960 
through August 1968. Several observations are possible from the two tables: 

• Two propellant combinations were used on the various stages— 
oxygen/hydrogen and oxygen/RPI . 
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Table 7. Saturn Program Summary 


V 

E 

H 

1 

C 

L 

E 

Test Start Date 

Test Complete Date 

Initial Acceptance 
Firing Date 

Initial Flight Date 

Number of Static Tests 

Number of Tests Aborted 

Number of Test 
Stages Destroyed 

Number of Flight Stages 
Acceptance Tested 

Number of Flight Stages 
Destroyed in Ground Test 

Number of Flight Vehicles 
Lost in Flight 

Saturn V 











S-IC 



02/24/66 

11/09/67 




All (15) 

1 SIC-II 

0 










06/29/69 


All System 

04/09/65 

08/03/67 



15** 

5 

0 




S-ll 



12 /01/66 

11/09/67 




Ail (15) 

0 

0 

Battleship 

1 1/09/64 

09/04/68 



54** 

29** 





All System 

04/23/66 

05/28/66 



9 

6 

1 


0 

0 








05/28/66 




S-IVB 



05/26/66 

11/09/67 




All (15) 

1 











01/20/67 


Battleship 

06/19/65 

08/20/65 



5*** 






Saturn IB 











S- IB 



04/01/65 

02/26/66 




Ail (12) 



All System 

10/26/64 

11/09/62 



3 

0 

0 


0 

0 

S-IVB 



08/08/65* 

02/26/66 

- 



All (12) 

0 

0 

Battleship 

11/24/64 

05/04/65 



16*** 


0 


i 


Saturn 1 







1 




S-l 



04/29/61 

1 0/27/61 




All (10) 



All System 

03/28/60 

07/17/62 



20** 

6 





S-IV 



08/12/63* 

01/29/64 




All (6) 

0 

0 

Battleship 

08/17/62 

05/04/63 
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All System 

01/24/64 

01/24/64 



1 


1 











01/24/64 





Second attempt NDHO07.01 

** Early test not included • see text 
*** Estimate 
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Table 8 , Saturn Program Design information Summary 
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• Various stages used either single or multi tanks for each propellant. 

• Stages used from one to eight engines. 

. Stages with single burn capability and both sea level and altitude start 
capability are included, as is a stage having duel burn capability— altitude start 
and earth orbit start. 

• All flight stages were acceptance tested prior to flight. 

• All stages were successful during flight. 

• Two flight stages were destroyed during acceptance testing. 

• Two propulsion system development stages were destroyed during testing. 

• Original planning for each oxygen/hydrogen stage included both battleship and 
all system test hardware, whereas each oxygen/RPI stage included only all 
systems "equivalent" hardware. S-IVB/V all system stage was diverted to 
structural testing after structural test stage failure. 

• The S-ll all systems stage was destroyed early in the test program. 

• The S-IVB/V battleship stage testing was very limited, and the stage was 
shipped to Arnold Engineering Development Center for altitude testing. Many 
stage requirements were satisfied by S-IVB/IB battleship testing. Note S-IVB/IB 
was a single bum stage, whereas S-IVB/V was essentially the same design but 
with dual start capability. 

• Numbers of attempted static firings varied significantly for various stages— a 
sum of 63 for S-ll battleship and all systems test article to 15 for S-l and 15 for 
S-IC. Numbers of tests exclude several ignition tests for each test article and 
initial testing when less than a full complement of engines were tested. See 
later text. 

• Similarly, the number of aborted tests varied significantly— from 6 for S-l, 5 for 
S-IC, and 33 for S-ll. 

• S-IB stage development testing is limited since differences from S-l are not 
significant. 

• Data for S-IV and S-IVB stages are incomplete. Presented firing attempts are 
believed to be approximately correct, but test aborts and other data are lacking. 


Stages Destroyed 

Two ground test stages were destroyed during development testing as were 
two flight stages during acceptance testing. Such stage loss must be prevented in 
future programs. Lessons learned from these experiences were highly beneficial 
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to the Shuttle program and should benefit future programs. The S-IVB flight 
was destroyed prior to actual hot firing when an ambient temperature high pressure 
helium storage sphere located internal to the stage on the thrust structure ruptured. 
Post rupture failure analysis identified unacceptable welding material had been 
used in sphere construction. The S-IC flight stage failure experienced a hydraulic 
fluid fire internal to the stage which resulted in an aborted firing with much 
propellant remaining onboard. Improperly implemented securing procedures 
resulted in the oxygen feed system geysering, not once but twice, with resultant 
feed system structural failures. Approximately 50,000 gallons of oxygen was 
dumped within the stage. The S-ll all systems test stage failed during check out 
operations. The liquid hydrogen tank ruptured during helium pressurization. Tank 
pressure was significantly above acceptable limits through a series of human 
errors. The oxygen tank of the S-IV all systems test stage was overpressured 
preparatory to a static firing. The stage was destroyed and the facility badly 
damaged. Redundant tank vent valves failed to relieve — the pilot valves were 
adversely affected by solid oxygen particles created by extremely cold helium 
pressurant gas. 


Discussion o f Development Firing Pr 
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Information presented in Table 9 provides greater insight into test programs 
for which data is available. The figure includes such things as: (1 ) the number of 
planned and completed full duration firings; (2) the number of tests which were 
terminated prior to plan because of stage fires, malfunctioning instrumentation 
which aborted tests, observers inadvertently aborting tests, tests aborted for 
legitimate reasons; (3) tests conducted early in the respective programs which 
have been excluded from other numbers presented in this table and in Table 7. 


S-IC. It is obvious from Table 9 data that S-IC was an exceedingly successful 
test program. Necessary test data were obtained from one vehicle configuration, 
number of tests were reasonable, preparatory testing considering a new test stand 
and a stage of such enormous thrust were reasonable, no fires developed and gas 
leaks occurred on only two tests. Instrumentation failures caused no test aborts, 
although three tests were aborted unnecessarily by human error. These results are 
explainable: (1) design experience — the stage was designed and manufactured 
by MSFC who had designed, manufactured, and tested the S-l stage and two 
earlier military vehicles; (2) the propellants were the same, oxygen/RPI , used on 
previous vehicles; (3) MSFC designers/managers had worked closely with the 
rocket engine developer on prior programs and each respected the other and were 
knowledgeable of work methods. 

S-l and S-IB . The S-l stage was also a highly successful program although 
considerably more testing was performed than for S-IC. The additional testing is 
easily justified. The S-l program preceded the S-IC program and represented the 
"basement floor” in learning and technology development. It represented 
approximately an eight fold increase in total stage thrust for liquid propelled stages. 
It used, for the first time, engines in a clustered configuration to create stages with 
"huge" thrust. It incorporated, for the first time, clustered state-of-the-art 
manufacturable relatively small diameter tanks to store these "huge" propellant 
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Table 9. Saturn Program Propulsion System Test Summary 
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quantities, and it required large thrust multi-use test stands with water cooled 
deflectors. This program was truly a learning experience in liquid rocket 
propulsion. No test or flight stages were lost. Fires were experienced on only two 
tests, and damage was small. Four of the twenty firings were aborted for 
instrumentation failures, and two additional tests were aborted for legitimate 
reasons. It served as the data base for the later S-IB stage which used uprated 
engines, longer tanks, aerodynamic fins for stability purposes, and other minor 
changes. 


S-IV . While no detail data is available for the S-IV stage, the approximate 
number of attempted firings of the battleship and all systems stages were 28. This 
stage used oxygen and hydrogen as propellants and an existing engine with 
15,000 pound thrust. No stage had previously flown using these propellants, 
although General Dynamics was developing a stage using the same propellants 
and engine. Douglas Aircraft (DAC) had acquired rocket development experience 
with the ballistic missile Thor which used oxygen/RP-1 propellants, but experience 
with hydrogen within the country, DAC, and MSFC was limited. This program, 
similar to S-l, while developing a stage which flew successful on six occasions, 
served the dual purpose of training and technology state-of-the-art advancement 
for hydrogen rocket systems. 

S-IVB . The Apollo program, at some later date, required stage total impulse 
and thrust greater than S-IV could provide. The S-IVB stage was developed to 
meet such requirements. It was used on a two-stage vehicle, Saturn IB, and three- 
stage vehicle, Saturn V. The stage for Saturn V required two separate burns, one 
approximately seven minutes after liftoff and the second several hours later from 
earth orbit. DAC was the S-IVB contractor and again propellants were 
oxygen/hydrogen. A single, newly-developed engine of 200,000 pound thrust was 
used instead of six clustered engines for S-IV. A total of approximately 21 static 
firing attempts were conducted with the S-IVB stage. Again data does not exist to 
develop more details. S-IVB flight stages on Saturn IB and Saturn V were all 
successful. Without the oxygen/hydrogen data base developed on S-IV, the S-IVB 
stage development program would have been less flexible, and more static firings 
would likely have been required. 

Sill. Detail data are available for S-ll, the second stage of Saturn V, which 
also used oxygen/hydrogen propellants. The stage was developed by North 
American Aviation, who had neither designed, developed, nor flown rocket 
propelled stages. Extensive training was required as noted previously for other 
stages. This was a "huge* stage using five 200,000 pound thrust engines, and, as 
was true for other stages of Saturn IB and V, was man rated. Total firing attempts 
for battleship and all systems vehicles were 63. There were 33 aborted tests. 
Sixteen successful full-duration firings were accomplished from twenty-eight 
attempted full-duration firings. Six tests were terminated because of internal fi res — 
relatively small to moderate damage. Ten tests were terminated for other legitimate 
reasons, and sixteen tests were terminated because of control instrumentation 
failures. The number of tests may be excessive relative to other Saturn programs 
and Space Shuttle, which may be considered comparable in complexity. 
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Pre-Shuttle stage designs and development activities were complex and 
involved awesome risks. Trained personnel were not available to the same extent 
as they were for Space Shuttle development, and technology which virtually did 
not exist had to be developed in stage and engine disciplines. In spite of these 
circumstances, the vehicle flight programs were all successful and many "lessons 
learned" were acquired. These lessons were of great benefit to Space Shuttle 
development, and the total list from Saturn, Space Shuttle, and from Air Force 
programs discussed later should benefit future programs. 

The major conclusion from these pre-Shuttle programs is that the Apollo 
Program would have been a disaster without the comprehensive propulsion 
system test program which was conducted. Experiences from the Saturn Program 
do not violate any conclusions presented earlier for Space Shuttle. Actually, 
experiences reinforce presented conclusions/accomplishments. 

Many technical accomplishments are presented and discussed in the 
respective appendices, 4 through 8, for all Saturn stages (S-IV stage of Saturn 1 
information is incomplete). These data are presented in the same format as was 
done previously for Space Shuttle's MPTA. Table 10, a tabular summary of this 
data presented according to technical and timing classifications, contains issues for 
each stage judged to be catastrophic and/or unworkable for either flight or preflight. 
A careful review of individual accomplishments in the respective appendices 
clearly shows the necessity for extensive propulsion system test programs. 

A memorandum entitled "Static Firing Saturn Stages" authored by Daniel H. 
Driscoll, Jr. on December 6, 1968, is included in Appendix 10. The question at 
hand was the necessity for continuing to conduct acceptance firings on each 
Saturn flight stage which had been, and was, standard policy. A thorough review 
of NASA's Saturn Program results to that date and the Army and Air Force's large 
rocket programs was conducted and results reported in subject memorandum. The 
objective of the study differed from the current study objectives, however, data 
presented relates to the current subject and should benefit management. The 
memorandum includes data on number of flights, number of failures, stages which 
been acceptance fired, length of acceptance firings, and some causes of stage 
failures. 

Conclusions drawn from the investigation are that acceptance firings of flight 
stages had been beneficial for enhancing safe flight and that the data provided little 
insight relative to the approximate time that acceptance firings could be deleted. 


35 



Table 10. Reported Propulsion System Testing Accomplishments Classified by 
Consequence and Time Phased 


Stage 

Catastrophe 

Unworkable 
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Total 
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■airnni 

HEmnnl 

Flight 

Preflight 

Flight 

Preflight 

Flight 

EzrntfHU 

S-IC 

4 

0 


3 

1 

0 

1 

i 

1 3 

S-V 

2 

0 

8 

8 

2 

0 

1 

0 

2 1 

S-IVB 

8 

0 


3 

0 

1 

2 

0 

20 

S-I/IB 

5 

1 


2 

2 

0 

1 

0 

1 5 

S-IV* 

2 

0 


1 

0 
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0 

0 
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LESSONS LEARNED 


The NASA programs of Saturn and Space Shuttle have remarkable flight 
records — 60 successful missions and only 1 failure (which was attributed to non- 
liquid propulsion systems). The non-flight phases of development programs have 
been less spectacular and problems of almost every conceivable type have been 
experienced. This is to be expected since basic technology establishment and 
personnel training was necessary in parallel with hardware and system 
development for many of the programs. Many of these experiences may not be 
readily anticipated and yet may be beneficial for future programs. Some of these 
more significant experiences designated "lessons learned" are presented. 
Presented "lessons learned" are from NASA's Saturn and Shuttle programs and 
from the Air Force Titan programs. 

Presented "lessons learned" emphasize testing and limited design aspects of 
propulsion systems. The items listed collectively demonstrate the contribution to 
successful space flight which ground test programs have made. In spite of the 
many "lessons learned" from the Saturn Program, the Shuttle Program is also 
credited with "lessons learned," thus it is reasonable to expect future development 
programs will likewise contribute their own lists. 

1. Verify functional performance of feed system; pressure drop, pressure 
surges, water hammer response, resonance. 

2. Preclude combinations of incompatible commodities in fluid systems. Three 
basic principals to follow: 

a. Provide absolute separation of incompatible commodities. Isolation 
valves and check valves are not sufficient. 

b Provide absolute controls during assembly, maintenance, checkout to 
mitigate migration, e.g., provide dry purges, dry enclosures to preclude 
moisture intrusion. 

c. Maintain systems under significant cleanliness controls during all 
operations. 

3. Assure procedures and processes are incorporated to achieve 
contamination control of contamination sensitive systems. 

4. Verify facility to launch vehicle interface design and operating procedures in 
conducting a ground test or firing of a flight propulsion system. 

5. Simulate actual environments, conditions, and designs. This usually 
appears to be impractical, costly, or near impossible, and it may be in some 
cases. 

6. Demonstrate margin during subsystem or system level test. 
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7. Use system level testing to fully understand the environments required for 
component qualification tests. 

8. Incorporation of a document which establishes guidelines for qualification, 
verification, and acceptance test of components and systems can be 
beneficial. The importance of the document would be guidelines to 
demonstrate margin for workmanship as well as performance purposes. 
The Air Force accomplishes this purpose through implementation of MIL- 
STD-1540B. 

9. Stainless steel tubing control lines are required. Aluminum control lines fail 
structurally. 

10. Fuel and oxidizer prevalves are absolutely required for static firing and 
recommended for flight. They must be capable, both structurally and 
functionally, of closure at full flow conditions in the event of an engine failure. 

11. Safe engine shutoff by prevalve closure should be demonstrated in a 
subsystem test prior to propulsion system testing. Valve closure 
acceleration characteristics must be carefully monitored. 

12. Thermal control of propulsion system components and electrical 
components is critical to satisfactory functional performance. Compartments 
containing such hardware must be purged for hazardous gases. Local 
thermal control of some hardware may be required. Caution is of utmost 
importance as such events as valve loss of lubricant, lubricity may be 
compromised, hydraulic fluid may freeze, etc. Such events may have 
disastrous effects to vehicle/engine performance. 

13. A loss of ground power may result in an inability to terminate a firing. An 
emergency system to terminate a firing is required. 

14. Single rocket engine development testing should simulate vehicle feed 
system start/main stage/shutoff conditions and engine compartment thermal 
conditions as may be realistically possible. This may reduce engine testing 
and operational aspects of the total propulsion system. 

1 5. Launch facility to vehicle supply lines for cryogenic propellants (particularly 
oxygen) must be designed carefully/property to permit flow diversion and 
control during chill down to prevent vehicle hardware damage. Procedures 
must be developed and concurred on by both facility and vehicle operations 
personnel. Verification at a non-launch site is advisable. 

1 6. Cryogen fluids, principally oxygen, geysering during propellant loading and 
standby operations both pre- and post-firing can create unacceptable 
pressures leading to structural failure of the feed system and/or tankage and 
possible vehicle loss. Procedures must be carefully prepared by 
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knowledgeable/experienced personnel, procedures properly focused, and 
personnel trained accordingly. Verification at a non-launch site is advisable. 

17. The opening of a valve to a system or partial system containing cryogen 
liquid propellant which have been "trapped" for some finite time can result in 
serious hardware damage. Provisions for pressure relief should be 
incorporated or special procedures adopted to minimize damage. 

18. Temperature and pressure instrumentation directly mounted to hardware at 
cryogenic temperature may be expected to drift, thus the indicated 
parameters may be significantly in error, and unacceptable as "redline” 
measurements. Test aborts will result. Remote mounting is necessary. 

19. A reliable hazardous gas detection and measuring system is required for 
stage static firing programs and pre-flight operations prior to launch. 

20. Rapid response leak detectors located both internal and external to the 
vehicle are required for safe operation. 

21. A reliable fire detection system is required for static test programs and may 
be required for launch site operations— subject to evaluation. 

22. Fire protection capability and internal protective neutralizing purges are 
required for static test programs and may be required for launch site 
operations — subject to evaluation. 

23. Specific pre-planned and measured personnel training and demonstration 
of qualification is a prerequisite for reliable, repeatable success. System 
failures were not responsible for the destruction of four stages in the Saturn 
program which have been identified. 

24 For hydrogen propelled stages, as a minimum, a ground system to safely 
dispose of engine discharged, unbumed hydrogen as part of start up is 
required to avoid excessive pressure spikes which may be incompatible with 
the stage. 

25. Steps to assure effective shift change communications and use of only 
experienced and qualified personnel is required. 

26. A process where contractor and government safety can perform spot checks 
on all hazardous work control documentation and operations is beneficial. 

27. Availability of an "off line" stage/facility during the early flight phases of a 
development program have proven highly beneficial. Data obtained from 
both cold and hot test of S-IVB at MSFC provided essential data for both the 
S-lVB and S-ll stages. MPTA propellant loading tests likewise supported 
Shuttle. 
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28. Recirculation of rocket engine plume low energy gases into the vehicle base 
may be the predominant heat source for clustered engine vehicles. Heat 
flux measurements from ground test programs to determine the relative 
contributions of convective and radiative heating and analytical methods 
developed to compensate for flight altitudes assist/establish design 
requirements. 

29. The phenomenon of "flow-induced vibrations" was initially experienced and 
recognized as an unusual event. Research programs identified the actual 
phenomena and developed guidelines for design. Major hardware losses 
are probable if improperly implemented. 

30. The phenomenon of subcooling a liquid propellant such as oxygen by 
injecting a gas-like nitrogen or helium was discovered and has been used 
extensively to thermally manage fluids on rocket systems. 

31. The necessity for a pressurant diffuser which gently distributes incoming 
pressurant gas within the tank ullage to avoid rapid ullage pressure decay is 
a requirement for effective tank pressurization. Extensive ground testing and 
analytical model development have been conducted to better understand 
requirements for pressurization systems. 

32. Severe fluid oscillations within heat exchangers as cryogenic liquids are 
converted to pressurant gas can occur and must be avoided. Test and 
analytical work provide useful design criteria. 

33. A complex launch vehicle may have 1000 or more fluid connectors ranging 
in size from one-quarter inch in diameter to eighteen inches or greater. A 
large percentage contain combustible fluids at moderate to high pressure, 
and a single leak can result in fire and vehicle damage/loss. Early design 
emphasis is a prerequisite to success but is difficult to achieve for such a 
non-glamorous discipline. 

34. Cryogen insulation development for large vehicle tankage is not straight 
forward, and each program is confronted with the commonly experienced, as 
well as unique development problems. Some of the common problems are 
insulation debonding, cracking, tank surface corrosion, inability to 
adequately withstand aerodynamically created thermal loads, etc. 
Conducting thorough development/test programs is essential, as is planning 
for insulation repair at the launch site after initial exposure to cold 
temperatures. 

35. Liquid nitrogen is formed on surfaces with temperatures below the boiling 
point. This usually occurs in the closed engine compartment of liquid 
hydrogen and liquid oxygen propelled stages and is to be avoided. High 
quality insulation on rocket engines and selected stage components is 
essential but is most difficult to achieve. 
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36. Inclusion of design margins in the initial subsystem/system designs provides 
flexibility to absorb stage requirement changes which frequently occur. 

37 System level tests are necessary to verify end-to-end tolerances for timing, 
limit checks, and remedial actions. Incremental subsystem tests do not 
adequately provide the system response signature found in integrated 
systems tests. 

38. Design, development, and test verification of a pogo suppression system 
prior to first launch is mandatory. 

39. Vacuum jacketed cryogenic line maintenance procedures and requirements 
must be developed prior to launch operations. 

40. A separate and independent test peculiar propellant tank ullage pressure 
instrumentation system must be installed for test stand operations. 

41 . Purge and pneumatic gasses must be dry. 

42. Micro-switch operation is unreliable under cryogenic conditions. 
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RISKS OF CURTAILING ALL-UP PROPULSION SYSTEMS TESTING 


The purpose of this section is to discuss the actual risks created by curtailing 
or eliminating system testing from a propulsion system verification program. The 
approach is to examine key items, define the present level of understanding, and 
make a judgement on the risk surrounding each item. 

The results of the risk assessment for space vehicles and facilities are 
presented in Tables 11 and 12. The evaluation considers no formal propulsion 
system test program within the development program . Results in Table 1 1 are for a 
new program using oxygen and hydrogen propellants, tankage of similar size and 
configuration to Space Shuttle, and a one burn mission with ignition on the launch 
pad. Table 12 is a qualitative comparison of various vehicle configurations and 
propellants with the configuration and propellant as shown in Table 1 1 . 

EVALUATION - OVERVIEW 

For evaluation purposes, the propulsion system has been divided into a 
number of subsystems/disciplines and each is evaluated. Evaluation parameters 
and other material included are: 

1. Risk - catastrophic failure, mission loss, flight hardware damage, launch 
complex damage, and launch delay and how these risks may be affected 
by a 20 second FRF type test 

2. MPTA experience identification for each evaluation subsystem/disciplines 

3. Impact on components, subsystems, and flight test programs attributable to 
no propulsion system testing 

4. Impact to the required flight measuring program 

The evaluation is qualitative. It was performed by personnel having many 
years of experience in propulsion system design, development testing, and flight 
support. Considered in the evaluation were analytical capability, including 
deficiencies for each evaluation criteria, inherent design complexity and influence 
of interacting systems, benefits derivable from propellant loading tests, design and 
operational aspects of space vehicles, and other factors. For additional insight to 
data in Tables 11 and 12 , a detailed discussion for each subsystem/discipline is 
presented in Appendix 2. Risk classes used were extremely high, high, moderate, 
low, or minor. 

A number of observations are possible from Tables 11 and 12, and they 
follow: 

1. Five of the fifteen subsystems/disciplines evaluated have risks ^hiah or 
above for catastrophe or mission loss. The five criteria are "wrong" 
component verification requirement, hazardous fluid leakage, POGO 
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Table 1 1. Propulsion System Program Assessment - No Propulsion System Test Vehicle Shuttle Type Tankage 
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Table 12 Propulsion System Program Risk Assessment — No Propulsion System Test Vehicle 
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NOTE: 1. Blank spaces denote same as Shuttle— column 
2. ^Varies with propellant selection. 



















failure, pressurization system failure, and propellant performance margin 
uncertainty. 

2. Twelve of the fifteen subsystem/disciplines evaluated may be expected to 
result in flight hardware damage. 

3. Five of the fifteen subsystems/discipiines evaluated are ranked moderate 
or greater risk to the launch facility. These are "wrong" component 
verification requirement, instrumentation failure, hazardous fluid leakage, 
propellant loading procedures, and stored gas operations. 

4. One or more twenty-second FRF type tests will reduce risks noted above 
but will not eliminate risk. The risk of four subsystems/disciplines 
evaluated remain moderate — hazardous fluid leakage, POGO failure, 
pressurization system performance, and performance margin uncertainty. 

5. The potential for launch delay risk are not affected by FRF type tests. Ten 
of the fifteen evaluation criteria are rated moderate or higher risk with three 
being extremely high— instrumentation failure, hazardous fluid leakage, 
and propellant mass uncertainty. 

6. Planned increases in component, subsystem, and flight development 
testing are relatively unaffected, but the potential for increased 
development flights prior to attaining operational status is likely for three 
subsystems/disciplines evaluated — "wrong” component verification 
requirement, pressurization system performance, and performance margin 
uncertainty. 

7. Flight vehicle instrumentation increases are necessary for eleven of fifteen 
subsystem/disdplines evaluated. 

8. Six of the fifteen subsystems/disciplines evaluated will be influenced 
additionally by changes in vehicle configuration, propellant type, location 
of vehicle at time of engine ignition, and numbers of ignitions. The risk 
increases significantly in some cases. The six affected criteria are: (a) 
pressurization system performance; (b) propellant mass uncertainty; (c) 
low level cutoff; (d) engine/feed system chill; (e) tank insulation; and (f) 
hardware thermal control. 

9. A common bulkhead configuration vehicle using oxygen and hydrogen 
propellants with multiple ignition and ignition in earth orbit would have the 
greater risk. 

In summary, the broad message from the above material is that a vehicle 
development program without propulsion system testing involves significantly 
greater risks from engineering and hardware failures which adversely affect 
program objective accomplishment, safety, and flight schedule predictability. While 
a short duration static firing at the launch site may reduce engineering and safety 
risks, the remaining risks are relatively high, and flight schedule predictability is 
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unaffected. The technology base for Shuttle configured propulsion systems is 
more advanced than for other vehicle configurations and missions, thus 
engineering, safety, and schedule risks for other configurations/missions will be 
greater. 

The evaluation under discussion includes structural/mechanical design 
capability for only a limited number of subsystems/disciplines, yet such capability is 
critical for accomplishing program goals. Some perception of hardware maturity 
may be achieved from Table 13 where hardware changeout for the MPTA is 
tabulated for each test attempt. The tabulation shows many vehicle and engine 
hardware exchanges during the program. The risks in Tables 11 and 12 are thus 
further enhanced. Tabulations in previously discussed sections dealing with test 
scheduling, why tests were aborted, propellant leaks and fires experienced for the 
MPTA program, and some similar data for earlier programs were also not used in 
the subject evaluation. The risk which is evident from these earlier discussions 
adds further credence to the risk presented in Tables 1 1 and 1 2. 

PROPULSION SYSTEM TEST PROGRAM 

This report has shown that available design knowledge and insight are 
inadequate to ensure acceptable hardware and operational procedures can be 
developed which satisfy both engineering and safety without propulsion systems 
test data. Discussions have also clarified the role of short duration FRF type testing 
for resolving issues of concern. While the FRF is beneficial, it fails to satisfy all 
technical needs and does not benefit concerns relating to launch delay. The 
obvious question is then what test program is required to satisfy engineering and 
safety needs? The time and cost required to conduct such a program are 
important, thus plan implementation to minimize program schedule and cost 
impacts are necessary. 

A test program to satisfy identified needs has been developed and is 
presented in Tables 14 and 15. In as much as vehicle configuration and mission 
profile may significantly impact the required test program, a vehicle and mission 
have been selected. The test program presented is for a launch type vehicle with 
ignition on the launch pad. Vehicles having altitude ignition, ignition in orbit, or 
differing radically in configuration would require a few— two or three — additional 
tests to address specific issues peculiar to those missions. 

The test program presented in Tables 14 and 15 is a minimum program and 
involves data collection for propulsion, structural, electrical, and computer/software 
needs. Tests are specified for the vehicle without propellants, with propellants 
aboard and no engines firing, and with engines firing. The test program identifies 
nine tests of which seven are hot firings and four of the seven are full duration 
firings. The program includes test objectives, estimated time in hours required to 
collect the necessary non-firing data, test objectives related to test number, and 
other pertinent information. 
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Table 1 3. Hardware Replacement and Repair by Test for MPT A 



Note: Hardware changes made prior to designated test number 
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Table 14 . Propulsion System Test Program Launch Vehicle - Ground Ignition 




MOTIVATION 
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TECHNICAL 

SCHEDULE 
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TEST NO. 
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Resonant Model Vibration 

X 


2 
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P 

1/2 
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Test 1 - dry; Test 2 - 
02 only 


Engine/Tank Purge 
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3 
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P 
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rVa 
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Propellant Loading 
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X 

X 
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P 
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Propellant Mass 


X 

3 
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P 
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rVa 
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Engine'Feed System Chill 


X 

3 
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P 
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02/H2 


Hardware Thermal 

X 

X 

3 

3 hrs. each 

P 
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Firing 

Component Environment 
Requirement 

X 


3 

2 fid duration 
minimum 

P 

W7 

60/full 

One of two with 
simulated engine loss 


Instrumentation Verification 


X 

4 

2 fun duration 
minimum 

P 

4/5/6Z7 

15'60/full 

Data also available 
Test 3 


Hazardous Fluid Leakage 

x 


3 

2 ful duration 
minimum 

P 

5/6/7 

60/full 

Data also available 
Tests 3/4 


Pressurization System 
Verifies Don 

X 


4 

3 hJ duration 
minimum 

P 

5/6/7Z8 

60/full 

One of three with 
simulated engine out 
one of three with failed 
control valve 


Propellant Margin Uncertainty 

X 


3 

3 niar ful 
duration 
minimum 

P 

6/8/9 

Ful 

3 tests with all engines 


POGO Failure 

X 


4 

25% total firing 
time 

S 

5/7/M 

60/full 

One test period with 
engine out; one test 
period with engine 
gimbaUmg 


Thrust Vector Control Failure 

X 


3 

15% total firing 
time 

s 

5/6/8 

60/full 



Clustered Engine 
Performance 

X 



2 short/1 long 

s 

3/4/6 

2 VIM* 



Low Level Cutoff 

X 


3 

Full duration 

s 

7/M 

Ful 

1 test - fuel; 2 tests • 
oxidizer 


Tank Insulation 


X 

3 

2 shortn long 

s 

3/5/6 

2-560/fuH 

Test 3 objective is 
toadinplong exposure. 
Test 5 is exposure and 
some vibration 


Stored Gas MaaVOperations 

X 


2 

2 near fun 
duration 

s 

err 

Ful 



Note; Space vehicle/aJtitude ignition vehicle requires modest additional testing tor broader ndhoot.oi 

objectives. 
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Table 15. Propulsion System Test Program Summary 
Launch Vehicle - Ground Ignition 


OBJECTIVE 

TEST NUMBER 

1 

2 

3 

4 

5 

6 

7 

8 

9 

TIME HOURS 



NON-FIRING 










Resonant Modal Vibration 

4 

4 








Engine/Tank Purge 


1 

1 

1 






Propellant Loading Procedure 


1 

2 

2 






Propellant Mass 



3 

3 

3 





Engine/Feed System Chill 


1 

1 

1 






Hardware Thermal 



3a 

3a 

3a 





TOTAL 

4 

7 

7 

7 

3 





FIRING 










Firing Duration, Seconds 

rVa 

n/a 

2.5 

15 

60 

Full 

Full 

Full 

Full 

Engine Thrust - % maximum 

n/a 

n/a 

n/a 

70 

100 

100 

100 

100 

100 








engine 

press 









out 

valve out 


FEATURES 










Component Environment 





X 

X 

X 



Requirement 










Instrumentation Verification 




X 

X 

X 

X 



Hazardous Fluid Leakage 





X 

X 

X 



Pressurization System 





b 

b 

b 

b 


Verification 










Propellant Margin Uncertainty 






b 


b 

b 

POGO Failure 





b 


b 

b 

b 

Thrust Vector Control Failure 





b 

b 


b 


Clustered Engine Performance 



X 

X 


X 




Low Level Cutoff 







X 

X 

X 

Tank Insulation 



X 


X 

X 




Stored Gas MassOpe rations 






X 

X 




NDH006.01 


Note: a - Time not additive 

b - Requirements affect test objective consolidation 
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For purposes of comparison, the MPTA program plan was for fifteen tests 
including three non-firing tests. Eight of the fifteen tests were to be for full duration; 
however, only six full duration tests were actually conducted. 

The reduction in recommended numbers of tests from fifteen for MPTA to nine 
for current planning is realistic and is attributable to; (1) an engine which is more 
mature, of current technology, and less complex than was SSME; (2) availability of 
demonstrated analytical tools for facility water cooled deflector design; and (3) 
availability of improved analytical techniques for vehicle design in a number of 
areas, thus the need for less extensive testing. The number of test attempts to 
complete the planned program should also be less than for MPTA due to 
availability of a more mature and less complex engine thus fewer failures and 
application of "lessons learned" relative to control instrumentation improvements 
and fewer red line violations. 

The test program in Table 15, as stated, may be considered the minimum 
program considering technical requirements, although the test program may not be 
compatible with minimum total program cost over the life of the program. This is 
because the minimum test program is developed to be compatible with the 
normally accepted method of developing/launching space vehicles— vehicle 
launch conducted and supported by the required, highly-trained technical 
personnel necessary to successfully accomplish the mission. This approach 
necessitates continual availability of significant numbers of highly-trained and 
specialized personnel which inevitably leads to significant program cost. An 
alternate approach whereby expanded propulsion system ground tests programs 
are conducted may lead to vehicle launch with smaller and less specialized launch 
crews. The acceptability of this approach has not been established nor is total 
program cost reduction assured. Repeated launch delays or the unnecessary loss 
of a single vehicle can affect total program cost and introduce extraneous factors 
which could best be avoided. Thus, careful evaluation is necessary should launch 
philosophy changes be contemplated. 
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PROPULSION SYSTEM TEST COSTS/BENEFIT DISCUSSION 


The rationale for test and verification (T&V) is that reliability will be improved 
by detecting and correcting design or manufacturing errors before they can cause 
failure during operations. The 'merit' of a T&V program can be evaluated by 
comparing its costs (e.g., test facilities, test equipment, test articles, and test 
operations) against its benefits (e.g., economic value of reduced failures). 

TEST AND VERIFICATION COSTS 

T&V costs rough-order-of-magnitude (ROM) in new launch vehicle programs 
can be estimated from past program costs. According to Rockwell/STSD data, 'test' 
costs (not including government furnished facilities and equipment or other 
government costs) have averaged 4.9 percent of 'non-recurring' DDT&E costs 
across Gemini, Saturn S-ll, Apollo CSM, and Space Shuttle Orbiter programs. 
Also, there have been only slight variations in test’ costs as a percentage of 'non- 
recurring' costs, ranging from 4.2 percent for the S-ll program to 5.2 percent for the 
orbiter program. 

To the extent that ‘test’ cost data were recorded and are available at the 
subsystem level, they indicate that structural, flight control (including hydraulics), 
avionics and propulsion subsystems are characterized by higher than average test 
costs (as a fraction of subsystem DDT&E). For example, on the orbiter program, 
MPS test costs (excluding SSMEs) ran 8.3 percent of MPS DDT&E. 

Based on historic T&V cost parameters, reasonable bounds on ROM T&V 
costs for a new (undefined) launch vehicle run from 4 to 6 percent of non-recurring 
DDT&E (e.g., a $5,000M DDT&E advanced launch system would include between 
$200 M and $300M of T&V); Of that T&V cost, roughly 10 to 15 percent would likely 
be spent on MPS testing (e.g., between $20M and $45M would cover the MPS test 
effort, again exclusive of facilities, equipment and engines). 

BENEFITS OF TEST AND VERIFICATION 

The economic payoff of T&V efforts is lower 'loss’ — the product of fewer 
failures during a system's operational phase or less serious consequences when 
failures occur. For example, if a $45M MPS T&V program for an unmanned, 
expendable advanced launch system were to prevent only one catastrophic failure 
during the fleet’s life-cycle of 200 to 500 launches, it would have justified itself ten 
times over by avoiding the loss of a ~$50M to ~$100M launch vehicle, the loss of its 
~$200M to ~$1,000M cargo, and the unavoidable waste of several hundred million 
dollars in 'fixed' costs during a period of fleet grounding. 

The economic payoff of T&V in manned, reusable or 'civil' space programs is 
immensely higher than in unmanned, expendable programs since the 
consequences of a catastrophic failure are immensely more severel For example, 
loss of Challenger (~$1 ,500M replacement value), its TDRS/IUS cargo (~$200M 
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replacement value), SRB re-design and 'fixed' costs of $3,000M - $5,000M during 
the stand-down, dwarf by a factor of twenty to thirty times the orbiter program's T&V 
outlays. 

Perhaps other 'non-quantifiable', but real losses (the crew, the agency's 
prestige, and the subsequent shifts in national space launch policy) could have 
been avoided with more extensive T&V efforts earlier. One 'lesson learned' from 
the history of launch vehicle development is that, while failures are both inevitable 
and terribly expensive, early T&V efforts to detect and correct the sources of failure 
before they occur are both effective and relatively inexpensive. 
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PROPULSION COMMUNITY QUESTIONNAIRE 


One of the major reasons for performing this study was to record the thoughts 
of many of the propulsion development engineers that have contributed so heavily 
to the success of Saturn and Shuttle— the "old hands" that are now contemplating 
new careers or retirement. A few Rockwell people have contributed heavily in this 
endeavor, but a questionnaire distributed throughout the NASA and NASA 
contractor propulsion community proved to be invaluable for preserving the 
judgement of managers and engineers with years of propulsion background. 

The response to the questionnaire was gratifying. Almost all respondents 
indicated a high interest in the subject and took the time to fill out a rather lengthy 
questionnaire. Table 16 is the list of respondents. The actual questionnaire is 
reproduced as Appendix 1 1 and is included for the reader's information. 

The responses to the question addressing the role of "all-up" system testing 
were almost consistent. These are included verbatim (except two which were 
paraphrased) in Table 17. In our view, the responses overwhelmingly make the 
case for propulsion system testing. 

The author's professional views on this question are included separately on 
Pages 60 through 66. 

ANALYTICAL HIERARCHY PROCESS 


In addition to the primary questions, the questionnaire contained a number of 
opinion trade questions which were analyzed by an analytical hierarchy process 
(AHP). This process is an attempt to quantify the collective subjective opinions of 
the respondents. The objective is to establish priorities based on cost, schedule, 
and reliability from five system verification methods: systems analysis only; 
battleship testing; flight configuration article testing; flight-readiness firing at the 
launch pad; or flight test only. All of the verification methods assumed previous 
component and engine development testing. 


The analytical method used to analyze the respondents' opinions is based on 
a book by Thomas L. Saaty, Decision Making for Leaders— The Analytic al 
Hierarchy Process for Decisions in a C omplex World, published in 1986. To quote 
the preface of this bookT^ — the AHP is a method of breaking down a complex, 
unstructured situation into its component parts; arranging these parts, or variables, 
into a hierarchic order; assigning numerical values to subjective judgements on the 
relative importance of each variable; and synthesizing the judgements to determine 
which variables have the highest priority and should be acted upon to influence the 
outcome of the situation." AHP is based on the fact that human reasoning works 
best when faced with only two choices. The process calculates preference 
weighted rankings of the different alternatives or choices available. (In this case, 
the alternatives are the various levels of testing.) Certain criteria are determined to 
be the most important factors in making a decision, and these are ranked according 
to relative importance among them compared to all other alternatives considenng 
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strengths and weaknesses relating to each pre-determined criteria. After all 
judgements and rankings have been made, a matrix is computed showing an 
overall score for each choice. The program used for this process can also 
consolidate the opinions and judgements of many individuals into a group choice. 

The results are shown in the accompanying table. The numbers in this table 
reflect the collective priorities based on the respondents’ opinions. The absolute 
values of the numbers are not meaningful, but the comparison between the 
numbers for criteria and test methods is significant. 

As was expected, reliability was the predominant criterion when compared to 
cost and schedule. Based on the reliability criterion, the highest priority test 
method was by flight configuration test article, followed by battleship testing. The 
priority assigned to the other choices was significantly lower, and the lowest 
ranking was given to analysis only. 


Table of Results 


Criteria : Which criterion is more important when planning a verification program 
for an advanced propulsion system? 


Cost 


Schedule 

Reliability 

.126 


.102 

.772 

Test Method: 

Which test plan alternative will result in the most reliable propulsion 
system? 

Analysis 

Oniv 

Battleship 

Testing 

Flight Configuration 
Test Article 

FRF Flight 

Testing Testing 

.038 

.211 

.484 

.123 .145 
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Table 16. Questionnaire Respondents 


Adams, Alan / Pratt and whitney 
Andrews, Byron / Rockwell 
Baker, J. L. / Rockwell 
Brasseaux, Hugh / JSC 
Breedlove, Dave / Rockwell 
Bruce, Jim / Rockwel 1 
Burg, Roger / Rockwell 
Burns, Robert / Rockwell 
Carlson, Norm / KSC 
Cobb, Bill / MSFC Retired 
Coester, Steve / Rockwell 
Connell, Don / Pratt & Whitney 
Corn, Graydon / NASA Retired 
Driscoll, Dan / NASA Retired 
Driver, Orville / Calspan 
Emerick, Bruce / Martin Mlchoud 
Flauss, Emille / Martin Michoud 
Fox, Ed / Martin Marietta Aerospace 
(By George Elliott) 

Glasgow, Lynn / Rockwell 
Glasser, Sid / Rockwell 
Harrison, Colin / MMC Denver 
Harsh, George / MSFC 
High, Dick / JSC 

Hildebrand, Arnold / MSFC Retired 
Hillbrath, Henry/The Boeing Co. 

Hokanson, Roland / Martin Mlchoud 

Jackson, Ed / Rockwell 

Johnson, John / Martin Mlchoud 

Johnstone, Harry / NASA Retired 

Kaser, Ted / Rockwell 

Kingsbury, James / The Boeing Company 

Lamberth, Horace / LSOC 

Lee, Sam / Rockwell 

Lincoln, Bob / Rocketdyne 

Lindsey, Bill / Rockwell 

Lyddon, T. E. / Rockwell Retired 

McCandless, Mark / Martin Mlchoud 

McCool, Alex / MSFC 

Mosbrook, Ed / Rockwell 

Muller, Phil / MSFC 

Norquist, Lawrence / Martin Marietta Corp. 

Odom, Jim / NASA HDQS 

O'Neal, Adrian / McDonnell Douglas 

Owen, Jim / MSFC 

Pearson, Jim / U.T.C 

Platt, Gordon / MSFC 

Pride, Bob / MSFC 

Redus, Jerry / MSFC 

Reid, Bill / Rockwell Retired 


Ritter, Glenn / MSFC 
Schaffer, Virgil / Rockwell 
Schwelkle, Dave / McDonnell Douglas 
Smith, Carlyle / MSFC Retired 
Smyly, Harold / MSFC 
Stewart, Frank / MSFC Retired 
Schwartz, Dick / Rocketdyne 
(By Jerry Johnson) 

Trott, William / Rockwell 
Vizek, Bill / Pratt and Whitney 
Winch, John / The Boeing Company 
(By James Stansel 1 ) 

Winstead, Tom / MSFC Retired 
Witt, Don/ Pratt & Whitney 
Wong, Dale / Rockwell 
Wood, Charles / MSFC Retired 
Wood, Jim / Eagle Engineering 
Worlund, A. L. / MSFC 
Zelse, Jim / Rockwell 
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Table 17. Tabulation of Questionaire Responses - 
Opinions of Role of All-Up System Testing 
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Table 17. Tabulation of Questionaire Responses - 
Opinions of Role of All-Up System Testing (Continued) 


* u *- 

< Z </> 

Z ~ W 




H H 
< V} 
Q U> 


in o 

> 

cc z 

C - 


C t- 

ml W 5 


I 1/1 D 

u z — 

> U » 


*- Z 

« Z 2 

> O O 


-J -j 

o -» 

CL < 


C - W U 1 


H 00 W 

n u t- 

u O W 

I- cj > 


o o 

2 

— CO 


3 H 
O = 
z o 


o « 

a. x 

z o 


-tO: 

— 

< » C 2 


ml 'ml U) 


a: o 

3 u 

00 w 


e O 

A1 X 

z & 


z o 
o - 


u 

*- B 
3 W 
-J 2 

o o 


< 

-J 

o 

K 

► 

s 

u 

u 

B 

O 


B B 

O < 
- O 


s 

ft. 

o 


? s 


o 

u 


o 

a. 

s 


s 

•- 


B M z B W 

— M H • 

HZ X 

m m »- 5 x 

MHZ O 
H « y - ■< 

> B I h 

A. » B O U 

3 O X « 

t u ac a ac 

j z ~ B v 


B ►* < 

u O X 

Z Z h 

o z 

a. < as 

8 ° S 

O Z H 

AJ O 


o => 

& > 
#- O oo 


> Z M • 

B O • 

U U U >• 

c 10 

-I < fc> 

< > ►« 

Z A. J 

O 3 « « 


< M B t- 

S < 3 « 

Ai Z U > 

a. u to 

O H < 

• < w 

• X U X 


H O 
to K 

> A. 


to 

u 

fr- 


O 

O 

O 


< 80 

♦- t- 

<0 z 
w u 

O 


— CL 

ml U 

a. o 

ft. 

3 H 
<0 Z 

< 

W -1 
Z -1 

— u 
O ft. 

z o 

U K 


> >-• 
-3 

o ~ 


57 



Table 17. Tabulation of Questionaire Responses - 
Opinions of Role of All-Up System Testing (Continued) 
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Table 1 7. Tabulation of Questionaire Responses - 
Opinions of Role of All-Up System Testing (Concluded) 


- < - 

at ' ) u 

hi 9) O U 

> H * I 

Z R R 

hi W X B 
HZ hi 
UJ O Z -4 
-S & hi O 

a. r u h 

r o 3 

O U H H 
u u -j 
U S 3 


Ifl I h 

m cn z 4 

m R 

z -j « co 

O H R I 
w t R W 

en 0 > H 

kJ U i 01 


< R 
z o 

R *4 


H cn z ft h 
k o mm 
O R R R R 


«J M > J 


< R Q y O 
r a. z h u 


u r o y. co 

z * o o >• 

M Z M H 03 
H M 0i h. 

cn r 

hi 

H O 


hi X 

* H 

o 


M X 
J R H 
R h. 

O \ • 


R R O I) N 

o r m q »- 

O O H hi 

R z < u y 

a. R K X o 


Z B 

M O 

z 


H D ft. Cl. 


cn o 

Z 3 ft} 

hi ft) ft. 

H Z K 

cn w 

h < x 


U M 

R at 

< 


M W 

en < 
<n x 

R 

ft. H 
>• Z 

a u 
Z 


O a 
z 

R a 
H U 
cn z 

K M 

R 


< o u 
03 H 
• hi m 
O B 
hi H 
> 01 K 
R H hi 
en m z 


co B R 
Z O 
O ft hi 


hi m 3 
O B Q 
hi B ■ 
hi H R * 

x m x tn 
H at ft 
U H 3 

m r o> 

hi hi O 93 
> X m m 
O H .J 
B k U 
a. on m 
hi X H 
H H H ft 

cn < m t 

w a 3 Z 


cn a o ft 

> Z H 
n R hi 
■ J 
ft 03 O B 
3 hi m m 
i b b m 
J 9 ft. H 
J ft > 
R hi «0 
U ft H 
Z O H B 
R B m ft 


hi H X 

o j h h. 
O -j o 

O R ft. 

U o hi 

a m j o 
ft H hi X 
U H > ft 
J U B 
hi R Q 
HZ hi 
ft ft ft X 

g' *- 

hi O hi Z 

O H K M 

ft O 

~ ft 3 

ft. CD hi O 

O O « Z 

•J M 

hi z cn ai 

> ft Z M 

hi z hi 

o >* h cn 
o m m 
o > x 
J a « h 

3 M 

O 3 hi ■ 
x -j z cn 
in y h h 


3 R hi z 

Z O 

- O hi a. 
>• M x z 
0C H H O 
OB U 


O * 
O • 
j a 
o z 


z z 

hi o 

H Z Z 

CO U o 

H O M 


O M x 
3 O 
cn o m 
H hi J 


X -J H 
H D H 
O - 
O X J 
H 01 - 
ffi 

O en r 

Z k o. 
M hi R 


•BO* 

h* ft* B 
B O Z 
O O J O 


B ft. B hi 
X K H ft 

t hi oo O 


ft H ft a 


O O 

U CL 

— Z 


3 H 

B 9J B 

m O 


HR m B U B 


hi M M o 91 


hi J Z hi hi 


0 3 0 

M O M 
h U h. 

B 


hi m 
Z X 
3 3 


Z ml 

O M 

M 3 


B M 3 

« > o 

ft Z 9) 


Z CJ -4 B ft 


cn m hi 

Z X z 
hi 3 hi 
H > 
« 9) M 

>• r h 


9 J 91 m B O 


o X 

B 3 


: « O J H • Z 

•OR B B 

I Z ZB B 

O ft ft H R O 

I m O ft. O 91 o 

• 9> hi M B 

•J R >1 J I k 


H 9 ) 


O 3 H ft ft 

Z ft. R H 

m 0 3 0 

H B H _ 

cn ft. 3 H • 


B ») 
X M 
3 
M 

O 9 ) 

B M 
B Z 

•J M 

o 

H Z 

B hi l 


Q Z H 
hl R X 
O B O 
Z B m 

B 0 . J 
> h. 
O ~1 
B *4 Z 


9 ) O 
d hi 

B 93 


Z X 93 
Z hi m 

O > X 


M B 
J > 

t* 

*8 

hi K 


i hi 


hi mi 


hi a. 
mi O 

O Z H 
BOH 


• 3 Z X O 4 X _ 

hi t H Z H > 

i Z 0 93 hi 

i m m b h m 


« > 
H B 
« X 


X 3 M 

H O H « 

MM CL 


N O 
X J hi 
0 B B 

MRS 

H z cn 

B hi B 
H hi 
Z J z 


B 

o o 


m > 
hi O 
h w 


Z J H 
B 3 Z 
z X B 
H m X 


u B 

3 

O 93 

u z 

o 

M 

O H 

M B 

X >4 

3 3 


H X B 
O > 

53“ 

b b m 
O ft. B 
O ft. 

B R H O 
ft. 9) hi 
O 3 M 

B W X ft. 


B ft. 

o 

• 

ft. « 

3 M 

• > 


0 M H O 

M Z B B 

H m 0 B 
u h h e 
9 M M M 
O O B B i 
H M 
* B X B 


B H 

a « 

9 H i 


Z O 
M K 0 
HOB 
H ft. B 


93 X O l. 
0 B Z H 

U B B ft. 


O S 

Z O 


& *4 
B 


hi J W 3 


hi o 

J z 

O B 


■J • O R 

MO « 

B H J R hi 

O J hi X 

ft. H M B H 

hi J 3 

B 3 BO 

hi R H X H 

X ft R H 


-J u ; 

B 93 O ■ 

O J B H i 

O B ft H I 

M | 

M hi hi *9 

X X X M 
H H H m 


0 H 
B CO 
ft. >• 


ft ft H 93 


mi O 


ft .1 

o * 

mi cn R 
M M z H U 

3 hi O Z m 

B m R J 
o o tn r a. 

Z hi hi a. 

BOO B 


H H 0 
BOH 
Z 0 
m u a 
O m 
H X 3 
X X o 
O O B 

M hi O 

•J H 
ft hi 
93 X 
M Z H 
H O 
R m X 
3 H O 
O R 
hi O O 
O m hi 
B Z B 
■ 3 3 
M Z 93 

> X B 

0 hi 


O B 
_ H ■ 

0 *4 


Z H Z O B X 


I O x H o B 


HUB 
B S M 
Z O I" 

M M 

X 93 
B hi 
X O 


B M 5 
•4 0 0 
9 B B 
X 

M H 
93 0 93 
X 3 
hi O 
H 03 *4 
B hi > 
3 O hi 
O O B 


H X . 
X H H 
0 m B 
H 3 hi 

B B ■ 


i o 

z z 

o M 

91 CL H Z > 

Z X 93 R -1 

hi o hi hi B B 

U H H O R 


O 40 

'' H 

93 m 


91 93 H Z 


3 M 
H 
-4 B 

«J B 

B O 
hi 
H H 


X 93 Z 
hi Z M 
> O Z 

M © 


01 

H hi K 
93 H hi 
B X 
>• 3 H 
ZOO 
B hi 
Z O Z 
B m 


hi 91 93 
U hi B 
0 ft 
B B H 
A. O mi 
99 J 
ft hi B 
O 3 
H O 
J H hi 
O m 

b j a 
H B Z 
Z 3 3 

o o o 


U X ft R 


3 X H H H C 


Q 01 R M X .4 

R 4 z K V) f. J 


3 hi H CJ 


hi {J 

91 Z X 
hi - R 
-3 H m 


Z m n 0 

hi H m X X 

Z H CO > 0 m 

Oft hi 
ft hi hi B O I 

Z U mi ft hi 

O z B cn o 

U O B ft B Z 


u b o m 


x cn a: 

hi M 

3 03 H 
H R 
H «4 X 
91 R H 
hi X 
H R cn 


ftRwcnfthicz 

ruachiOHinw 

O R hi H R R X 

U -J 3 * 3 W 3 

9) >• O a: 

X hi m X H hi > 


93 B H X hi hi 


O 0 Z hi 93 


m H 
3 

H 


H H hi B H 93 


BX*4MH X X X X 0) CJ Z 

B33BHM0ftHMHM R 3 B O 


OHM 
X X « 


M m H H 


M 9 X ft X ft 


M X 
ft 91 X B 

0 X H B 

B O • 

Z B O O O 

O O Z B X M 93 

m 0 B ft m 

m m a. H B H 

OBOUftcntncn 


X 

x • 0 

H O 
' O X 
•4 M ft 

3 m O 
0 O 


hi m 

ft ~ 
H 


H 
H 
3 m 


M 9 93 *4 


ft a > 3 h 


B 3 

w O 

O B m 

m o at 


X hi 
O H B 
m D O 

X H ft 

t H 

H H 
X 93 B 

O B X 
3 H 
9) 93 

M X 

91 93 3 

R B O 


> O ft z en d r 


ftUW9)B03ZB 


0 9) M 03 H hi 


hi B l O H 


B M 
3 X 
O O hi 

O Z mi 

B B hi 


3 3 
O -4 
hi M 

O B 
B ft 


M > 91 H M *4 H 


3 Z 

h) B l 

93 hi l 

h a z 

91 o 1 

hi H l 
H m f) i 
H . 

HOB 

Z B hi 
hi X H 


B X 
ft H 
Z 

o 


U 0) B >• 

3 R HO 

z x cn m h 

R mi 

Z cn X hi H 


59 



THE ROLE OF PROPULSION SYSTEM TESTING — CHARLES C. WOOD 

Is there a role for propulsion "system" testing for space vehicle development 
today in the high technology age? Managers of new space vehicle and military 
missile development programs are confronted with this issue. Considerable 
pressure confronts each program manager to reduce high, up-front costs of 
development programs. With limited ways to accomplish this low-cost objective, 
the omission of propulsion system testing may be one alternative to achieve 
desired funding reductions. Are such cost savings real or are they merely deferred 
to reappear later? Is program reliability impaired by such action or can it be 
achieved equally well by some other means? 

More than 40 years devoted to the engineering aspects of space vehicle, 
military missile development and aircraft research in which some failures and many 
successes were achieved firmly imprints in my mind many important principals if 
success is to be achieved. My opinion regarding the desirability of propulsion 
"system" testing is unequivocally "yes," although circumstances may support 
carefully selected testing omissions. The following paragraphs discuss various 
aspects of propulsion "system" testing. 

Propulsion "System" Tes t Requirements 

Although exceptions are possible, propulsion "system" testing is essential for 
newly-designed manned vehicle programs: in the practical world, exceptions are 
limited. Circumstances which may permit propulsion "system" testing omission 
would be design similarity and use of state-of-the-art technology for all systems, 
both of which are unlikely for new vehicles. Prerequisites for vehicle programs 
without propulsion "system" testing are: (1) all systems must be thoroughly 

analyzed; (2) the interaction between systems must be thoroughly analyzed; and 
(3) the benefits of Flight Readiness Firings (FRFs) are thoroughly evaluated and 
implemented where shown to be beneficial. This approach is necessary because, 
as experience has shown, supposedly benign design changes frequently lead to 
serious operational or performance difficulties capable of inducing mission failure. 
Therefore, to avoid such unacceptable occurrences, propulsion "system" testing for 
manned missions is warranted when there is incorporation of a new engine 
system, a new pressurization system approach and hardware, or a new feed 
system design and hardware. 

Objectives of a propulsion "system" testing program are: (1 ) to demonstrate 
that each separate system provides the required performance when interacting 
with other related vehicle systems; (2) to demonstrate that the structural capability 
of all systems is adequate; (3) to verify that methods devised for operations of all 
propulsion systems and the necessary supporting ground systems are correct, 
safe, and compatible; and (4) to show that ground systems have adequate 
capability and margin. Alternatives for determining flight worthiness of propulsion 
systems - analyses, FRF, and flight test programs - may be considered, and while 
they may provide program benefits, they also have major deficiencies. These 
alternatives are discussed in later paragraphs. 
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Aside from the engineering issues associated with propulsion "system" testing 
are other important issues — public and political images. A major concern, 
especially in manned programs, is public and thus political opposition. Launch site 
test programs highly visible to the public, which experience hardware failures, 
schedule delays and cancelled milestones are prime candidates for public distrust, 
unfavorable publicity and potential budgetary problems. The American perspective 
often overlooks the fact that failures are frequently necessary steps to achieve 
success. Propulsion system" testing is less visible than FRFs, aborted or delayed 
flights, or in-flight failures with personnel aboard. 

Propulsion "system" testing is not always essential for unmanned vehicle 
programs- From technical considerations, however, such testing is warranted, is 
highly beneficial, and is believed to be cost effective. Technical needs are the 
same as for manned vehicle programs. The public and political perceptions are 
similar but at a lower intensity, and the visibility of events can be purposely 
reduced. These features enhance the program manager's option to select 
alternative ways to develop and verify vehicle system performance to accomplish, if 
possible, front-end cost reductions and, potentially, total program cost savings. 

System Verification bv Analysis 

Since initiation of the Apollo program, a technical revolution has occurred in 
the aerospace field. 

• The United States industrial complex has become more heavily involved in 
space and missile programs. 

• University graduates are better trained and have specialties in multiple aspects 
of aerospace science. 

• Computers with almost limitless capability are available for increasingly complex 
analyses. 

• Manufacturing machines and processes, as well as improved materials and 
methods of inspecting sophisticated products have all improved radically. 

Ingredients thus exist today for providing vastly improved products. The 
Space Shuttle program, initiated 15 years after Apollo, capitalized on many of 
these improved capabilities, which are continuing to improve. Considering today's 
technological base, why can't system integration development and verification be 
accomplished by analysis? The answer to this question is provided in the following 
paragraphs. 

Development and verification of a space vehicle/missile involves many 
disciplines and the interactive influence of each discipline. Examples of the 
various disciplines are: static and dynamic loads and their distribution, structural 
analysis and design, structural dynamics, acoustics, aerodynamics, fluid 
mechanics, fluid dynamics, mechanical design, thermal analysis and design, 
hydraulics, propulsion design, materials sciences (properties, corrosion, fracture 
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mechanics, crack propagation, life cycle, etc.), electrical power and distribution, 
power control, computers, and software. Many of the same disciplines are involved 
for supporting ground systems. This necessary and formidable array of talent is 
even more perplexing in that all disciplines must work together to assure success. 
Computers only perform as programmed; thus the real burden for success rests 
with design, analysis and system specialists. Assuming that the necessary 
knowledge exists to design each subsystem, does the knowledge exist to establish 
interactive influences of these many disciplines? Does management discipline 
exist within the system not only to permit but to mandate such interrelated activity? 
Do development schedules include sufficient time for such functions to be properly 
completed? Is the work environment of those who must participate buffered from 
every day pressures associated with normal development programs so that the in- 
depth, multi-disciplined thinking can be accomplished? Based on history from 
participation in more than 12 development and many research programs, the 
answer to most questions is absolutely not! 

Oversight Examples 

A few examples of "oversights" of consequence from past programs will 
emphasize this conclusion. Also included for improved insight are a few examples 
of data required from propulsion "systems" testing which are necessary for 
integration analyses. The examples are drawn from the Apollo, Skylab, and Space 
Shuttle experience. 

1. On Skylab (the nation’s only Space Station to date) one of the two cable trays 
running along the vehicle length was torn off the vehicle during powered flight. 
Included within the tray was one of the two stored solar arrays. In orbit, the 
Skylab’s electric power was consequently less than planned, and the thermal 
balance within the Skylab was lost; the mission was salvaged only by almost 
super-human efforts. The provided cable tray vent area was either inadequate 
or the local aerodynamic pressures at the vent locations were greater than 
design values; thus vent flow was restricted and excessive pressures resulted. 

2. During static firing, one S-IC stage experienced a hydraulic fluid-fed fire. 
Subsequent to successful test termination, two liquid oxygen (liquid oxygen) 
feedline geysers occurred and ruptured hardware, allowing 50,000 gallons of 
liquid oxygen to flow uncontrolled into the thrust structure and onto the engines. 
Failure of the test conductor to follow procedures and failure of the procedures 
to be properly emphasized relative to geyser prevention were responsible. 
Propulsion "system" testing benefits crew training and procedure development. 

3. The need to revise design requirements for propellant position control within the 
liquid oxygen and liquid hydrogen tanks (which permits venting of gases during 
orbital operations) was detected late in the Apollo program, but fortunately early 
enough to save the program from failure and embarrassment. The technical 
issue involved was slight vehicle drag which repositioned propellants from the 
designed zero gravity propellant configuration, thus preventing gas-only 
venting. At that time, all related American research was based on zero gravity 
conditions for earth orbit operations. Consequently, no liquid vapor separator 
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existed to enhance workability of the designed system in the actual 
environment. After the facts were realized, the propellant control concept was 
changed, associated systems were redesigned with inclusion of much new 
hardware and deletion of old hardware, and a special flight test experiment 
vehicle was developed and flown to measure and photograph fluid behavior 
and establish system performance. The basic cause of this incident was 
inadequate perception of events that resulted in inadequate modeling, 
incomplete research throughout the country and the unfavorable influence of 
these factors upon the design specialist. 

4. Pressurant diffuser structural failure in the Space Shuttle liquid hydrogen tank 
occurred several times. The diffuser was initially constructed of aluminum and 
component testing had been successfully completed prior to propulsion 
"system" testing. Structural failure of a diffuser in the liquid hydrogen tanks was 
unexpected (although not unusual in the liquid oxygen tank) as were similar 
failures for several modifications. The failure mechanism was flow induced 
vibration; a change in material from aluminum to steel was required to achieve 
a satisfactory design. 

5. Structural testing of tankage on Space Shuttle detected deficiencies in both the 
liquid hydrogen and liquid oxygen tanks. Problem resolution was possible 
through major manufacturing changes which would be costly and result in 
significant schedule delays. Although contrary to the original vehicle design 
and operating philosophy, problem resolution was also possible by maintaining 
positive pressure within each tank commencing with propellant tank loading. 
Discovery of these problems coincided with initial propulsion "system" testing. 
Studies revealed vehicle vent valve controlled cycling (alternately opening and 
closing) during propellant loading and standby could be utilized to control tank 
pressure within specified ranges; costly tank changes and schedule delay were 
thus avoided. This approach for controlling tank pressure was developed and 
verified during propulsion "system” testing and the approach continues today. 
Unavailability of a propulsion "system" testing program would have delayed its 
development until flight hardware and launch complex completion permitted 
testing at the launch site. Program risk and cost would have been greater and 
significant schedule delay would have occurred. 

Tvoical Data Requirements Examples 

Three examples are included for which data are difficult to obtain other than 

from propulsion "system" testing. 

1. Vehicle structural and propulsion system dynamic interaction (POGO) is a 
complex phenomenon which can have devastating consequences. 
Sophisticated analyses are necessary to establish stability margins and provide 
assurance of safe operation. These analyses are dependent, however, upon 
experimentally determined inputs which are generally the results of feed system 
data collected both with and without controlled input pulsing of the feed system 
during normal vehicle firing. These data are needed for various propellant 
levels within the tankage. This operation introduces risk and requires 
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modification to the vehicle flight configuration to accommodate the pulser and 
necessary special instrumentation. 

2. This example represents a broad issue involving propellant management. 
Included are propellant loading, propellant volumes within the tanks and safe 
engine shutdown. Total data needs are unavailable from other sources unless 
full-duration FRFs are performed. Safe engine shutdown involves operation of 
the low level cutoff systems to assure adequate propellants are available during 
the shutdown cycle. Such testing involves risk to both vehicle and facility. 
Accurate propellant volumes are necessary for predicting vehicle performance. 
It is important because vehicle tankage volumes are calculated from drawing 
dimensions (including both plus and minus tolerances) while the finished tank 
volumes change with thermal exposure and loading. Propellant loading relies 
on accurate information to a known tank level. Involved are proper location of 
sensors, reliable hardware, understanding of propellant flow currents within the 
tanks, interaction of loading sensor electronics and ground computer systems, 
and software/hardware compatibility. 

3. This example relates to preventing hydrogen gas venting during initial flight 

phases. At altitudes below approximately 50,000 feet, burning of vented 
hydrogen can result in unpredictable consequences. Involved are six 
independent factors: (1) aerodynamic heating generated by the vehicle 

configuration and trajectory; (2) vehicle insulation design which controls heat 
input to the hydrogen; (3) pressurization system performance and control 
system tolerance; (4) vent valve tolerance; (5) tank structural capability; and (6) 
liquid hydrogen stratification within the tank. Data on each of these are 
necessary to support analyses concerning hydrogen gas venting, and data on 
all but (1) are obtained from propulsion "system" testing. 

Other Consi derations 

If propulsion "system" testing is not performed, management must be prepared 
to accept generous scheduling after flight vehicle arrival at the launch site 
preparatory to launch to accommodate problem discovery, fix determination, and 
probable retrofits. Furthermore, management must be prepared to deal with the 
critical press, political, and public environments resulting from inability to launch as 
planned and/or inflight anomalies. In spite of all design and integration analyses, 
component testing, and subsystem testing which have been conducted prior to 
arrival at the launch site, one should expect numerous malfunctions when initial 
ground and vehicle systems interface. This fact is even more pronounced when 
propellant flows begin as indicated in the preceding examples, which represent 
only a few of many possibilities which may have to be resolved before launch can 
occur. It may take weeks and several propellant loadings prior to complete 
resolution. Resolution of these many issues introduces the concern of ever-present 
safety factors which management must consider. Although cost has only been 
mentioned in passing, total program cost without propulsion"system" testing could 
easily approach or even exceed program cost had propulsion "system" testing 
been included initially. 
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System Verifi cation bv Flight Readiness Firing 


This subject has been discussed indirectly to some extent in preceding 
paragraphs relating to analysis. It is now advantageous to consolidate thoughts. 

As the name implies and as customarily conceived, the FRF assures vehicle 
readiness for flight and readiness of the launch complex for performance of 
required functions. The vehicle design, launch complex functions and integration 
aspects should normally have been proven elsewhere. The FRF for each new 
Space Shuttle vehicle, conceived on this basis, was fired for only 20 seconds, 
being more than adequate to accomplish its limited objectives. 

For a new development vehicle involving new technologies and/or numerous 
dissimilarities from previous vehicles, an FRF can substitute for the propulsion 
"system" test program, although it can not be perceived as the limited test noted in 
the immediately preceding paragraph . In essence, the FRF must become a 
program itself — a propulsion "system" testing program conducted at the launch site. 
Such an approach will: (1) increase the time between program initiation and first 
launch due to delayed identification of problems and satisfactory resolution; (2) 
increase risk to the flight vehicle and the launch complex resulting from conduct of 
development tests, increased numbers of tests and longer duration tests; (3) result 
in higher program cost because of greater launch facility complexity, increased run 
requirements and imposed additional safety considerations; (4) measurably 
distract launch site personnel from accomplishing normal launch site functions; and 
(5) most importantly, reduce reliability of the vehicle and endanger the flight crew. 
This approach is not recommended generally, although for vehicle programs 
having considerable similarity with previous programs, it may be an acceptable 
and effective approach. 

The FRF or "mini" propulsion "system" testing program will necessarily involve 
one to six propellant loadings and hot firing tests or more. The goal of the 
expanded FRF program continues to be verification that the vehicle is ready for 
launch. The issues discussed under the analysis section (and many others which 
were not included) portray the real world— development activities must precede 
verification for launch. 


System Verification bv Right Testing 

The final issue to be considered is flight vehicle test programs— development 
programs without the customary propulsion "system” testing and including the 
normal FRF. The FRF would resolve the many preflight development type issues 
and those related to short duration firings but would not include long duration firing. 
This approach is unacceptable for manned flight programs. The approach may be 
acceptable for unmanned programs. For unmanned programs, prerequisites for 
technical acceptance are thorough analysis of all systems individually and then as 
integrated systems. Management prerequisites are also involved and include all 
issues relative to the FRF in the absence of the normal propulsion "system" testing 
program. These include cost, risk, public image, and other issues. The subject 
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approach and postulated loss of an unmanned vehicle could easily result in total 
program cost greater than initial inclusion of a formal propulsion "system" testing 
program. 
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CONCLUSIONS AND RECOMMENDATIONS 


Propulsion system development test programs for the seven Saturn stages, 
Space Shuttle, and some Air Force programs have been reviewed and evaluated 
for the purpose of documenting significant results of those various programs for 
future reference. Program benefits attributable to propulsion system testing are 
emphasized. Key technical design parameters are identified and program risks 
associated with curtailing propulsion system testing for each design parameter is 
discussed. The following conclusions and recommendations result from this study. 

CONCLUSIONS 

1 . Propulsion system testing has prevented several catastrophic flight failures. 

2. The complexity of interactive characteristics of the propulsion, structural and 
electrical systems defies accurate analytical representation. Propulsion system 
testing provides the necessary test data for "model basing" thus enhancing 
system analysis techniques. 

3. A propulsion specialist survey characterizes propulsion system testing to be 
"mandatory." 

4. Propulsion system testing determines hardware integrity and functional 
performance in the best possible environment excluding flight. Testing also 
certifies the environments utilized for component development and 
qualification. 

5. Propulsion system testing integrates vehicle and ground hardware and 
procedures for propellant loading, safing, and firing operations for all systems. 

6. Propulsion system testing provides a resource for determining stage/engine 
design margins, developing procedures and timelines and confirmation of 
extrapolated criteria used in engine development. 

7. Potential risks for catastrophic flight failure, mission loss failure, vehicle 
hardware damage, and launch complex damage is reduced by propulsion 
system testing. 

8. Potential risks for a delayed initial launch and subsequent launches is 
significantly reduced by propulsion system testing. 

9. Propulsion system testing is required for new stage designs, advanced 
technology concepts introduced within major systems of existing designs, and 
possibly for existing designs modified to accommodate one or more major 
system redesigns. Full duration test firings are normally needed to satisfy 
system test requirements. 
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10. The "economic payoff" of propulsion system testing in manned and reusable 
space programs is higher than in unmanned, expendable programs since the 
consequences of catastrophic failures are more severe. 

1 1 . Propulsion system testing which prevents loss of only one vehicle may be 
considered cost effective to the program. For some programs, cost effectivity 
may be realized without vehicle loss. For unmanned, expendable stages, a 
program cost saving ratio for a single failure event may vary from near one to 
five or greater dependent upon cost of lost payload, fleet grounding, and other 
factors. 

12. Factors to be included in propulsion system testing decisions are loss of life 
potential, cost, schedule, state-of-the-art design and procedures, history of 
design, design similarity with other programs, test site capabilities, and the 
agency's prestige and subsequent shifts in the national space policy in the 
event failure results. 

13. Various methods for satisfying necessary program test and verification 
requirements are a separate development test vehicle, the normal or modified 
flight readiness program using flight hardware and a flight test program. Each 
development program must establish necessary test requirements and seek 
the single or combination of approaches which best satisfy established 
requirements. 

RECOMMENDATIONS 

1. New stages involving designs dissimilar to previous stage designs, stage 
redesigns incorporating advanced concepts in major systems and/or including 
advanced technology designs, hardware and/or materials shall include 
propulsion system testing. Program managers shall assess and establish 
programs for satisfying requirements including crew/passenger safety. 

2. New stages similar to existing designs which exclude new technology may 
require propulsion system development and verification testing. Program 
managers shall assess and establish programs for satisfying requirements. 

3. Propulsion system test hardware and test facilities necessary for conducting 
propulsion system testing shall be retained for rapid activation to firing status 
commensurate with resolving failures/anomalies from the early flight program. 

4. Vehicle propulsion system test hardware and facility interfacing hardware shall 
duplicate flight vehicle/launch complex hardware wherever possible. 
Engineering's concurrence is suggested for usage of substitute hardware. 
Launch site operating procedures shall also be duplicated wherever possible. 

5. Test hardware maturity standards shall be established as a prerequisite for 
propulsion system testing initiation. This may enhance safety, reduce risks to 
hardware and test personnel, and reduce cost. 
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6 Accurate and reliable instrumentation is vital for any successful test activity. 
Operating margin for hardware and systems may be the basis for reliability 
enhancement. Testing within "actual" environments for which hardware must 
perform is crucial to success. These three elements shall be evaluated and 
incorporated realistically in test programs to the maximum extent practical. 

7. Development of a document which would serve as a guideline for all testing — 
qualification, verification, and acceptance test of components and systems to 
demonstrate margins for workmanship and performance purposes would be 
beneficial and should be considered. 
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S-ll Battleship Monthly Test Reports, March 1966 - May 1967 

SID 66-967 Saturn All Systems (S-ll-T) Stage Static Firing Test Report 


H. S-IVB REPORT 


Douglas Report SM-46973 

I. TITAN REPORTS 


Titan II Missile N-1 Right Test Report 

The Gemini Program Launch Systems Rnal Report No. TOR-iooi 


(2126-80)-3 


J. SHUTTLE MAIN PROPULSION TEST REPORTS 

Rockwell International briefing charts entitled, "Main Propulsion Test Program, 

NSTL." _ 

History of MPT Test Program, dated February 9, 1986 
MPT Tanking Test History, dated July 1983 

Quick Look Test Report - MPTA Static Fmng No. 1 - Tests MPT-S1-001 and 
MPT-S1 -002 

MPTA Static Rring No. 2 - Test MPT-S2-001 
MPTA Static Rring No. 3 - Test MPT-S3-001 
MPTA Static Rring No. 4 - Test MPT-S4-001 
MPTA Static Rring No. 5A and 5 - Tests MPT-5A and 


Quick Look Test Report 
Quick Look Test Report 
Quick Look Test Report 
Quick Look Test Report 
MPT-5 

Quick Look Test Report 
Quick Look Test Report 
Quick Look Test Report 
Quick Look Test Report 
Quick Look Test Report 
Quick Look Test Report 


MPTA Static Firing - Test MPT 6-001 
MPTA Static Firing Tests - MPT 6-02 and MPT 6-03 
MPTA Static Firing Tests - MPT SF7-001 
MPTA Static Firing Tests - MPT SF7-02 
MPTA Static Rring Tests - MPT SF8 
MPTA Static Rring Tests - MPT 9-01 and 9-02 
Quick Look Test Report - MPTA Static Rring Tests - MPT 10-01 
Quick Look Test Report - MPTA Static Firing Tests - MPT 1 1 -01 
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Quick Look Test Report - MPTA Static Firing Tests - MPT 1 1*02 
Quick Look Test Report - MPTA Static Firing Tests - MPT 12 
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APPENDIX 2 


RATIONALE SUPPORTING NON-TEST RISKS ASSESSMENT 

An overview of the material presented in this appendix has been presented in 
the main body of this report. Tables 2-1 and 2-2 are repeated here for reader 
convenience and summarize the results in tabular form (Tables 11 and 12 in main 
body). This appendix provides additional insight relative to the risks assignments 
for each subsystem/discipline evaluated. The risks relate to propulsion system 
development without propulsion system testing. The judgement classes for risk are 
extremely high, high, moderate, low, and minor and are based on frequency of 
occurrence in previous propulsion systems test programs, evaluation of analysis 
and design capabilities, characteristics of stage design, including redundancy, 
operational method, and other considerations. 

"Wrong" Component Ve rification Requirement . The risk of early catastrophic 
inflight failures due to components being verified to the "wrong" requirements is 
judged to be extremely high. .Examples of previous test failures of this type are the 
hydrogen pressurization system diffuser failure in the Shuttle hydrogen tank 
(potential hydrogen tank structural collapse due to insufficient ullage pressure) and 
the SSME main fuel valve failure in the orbiter aft compartment (compartment 
structural failure and fire damage). 

Component operating and verification requirements are established well 
before the propulsion system is assembled and operated. Computer simulation 
analyses are well developed and are used to establish loads, pressures, operating 
temperatures and flow rates. Vibroacoustic environments induced by the various 
subsystems or components are difficult to manage, as are interactive influences of 
various environments and subsystems. Validity of requirements depends on the 
knowledge and experience of the design group, and yet the best of design groups 
are unprepared for these hundreds of components in such complex environments. 

Correct requirements are not known completely until a system test program is 
conducted, including efforts required for data analyses and comparisons to 
individual component requirements. It can be stated that no component is verified 
until it has been subjected to a systems test program. FRF type firings can help to 
quantify environments for components, although availability of such data is late, 
and it must be carefully evaluated which results in delays. The flight 
instrumentation program must be significantly enlarged and the complex/costly 
launch site is exposed to additional risks. 

Instrumentation Pe rformance . The risk of launch delay is judged to be 
extremely high, the loss of mission and other considerations moderate. Launch 
scrubs and resultant schedule slips will result from inability to verify launch 
constraints due to failed (actual failure plus inaccuracies due to environment) 
instrumentation. Inability to analyze anomalies and inflight failures due to high 
instrumentation failure rates may be expected, and decision-making capabilities 
necessary to prevent failures will be adversely affected. 
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Table 2-1. Propulsion System Program Assessment - No Propulsion System Test Vehicle Shuttle Type Tankage 
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Table 2-2 Propulsion System Program Risk Assessment — No Propulsion System Test Vehicle 

Non-Shuttle Type Tankage — Risk Relative to Shuttle 



with propellant selection. 











The time required to correct instrumentation deficiencies and to verify 
operational acceptability is usually extensive. All early propulsion system 
operations experienced multiple instrumentation failures. For MPTA, 
instrumentation failures resulted in cancellation of two planned firings. Terminal 
count interruptions/delays necessary to devise new procedures, to work around 
instrumentation failures, and to continue terminal count were also necessary on 
numerous occasions. Similar problems occurring at the launch site would have 
resulted in launch cancellations. The judged mission loss risk would be extremely 
high, except that most critical sensors are normally redundant. 

Ground test allows the use of drag on instrumentation with wide band width 
capability. Flight vehicle instrumentation, on the other hand, is classically low band 
width to verify normal expected operation of systems only. This is a fall out of the 
telemetry total band width which precludes high frequency monitoring of a large 
number of measurements. The ground test operation allows "quick response" with 
additional measurements as needed as opposed to the flight systems which have a 
long turnaround time. 

ElQpellant. Hydraulic Fluid and Ho t Gas Leaks . The risk of an early 
catastrophic and mission loss due to an inflight leak are judged to be high. The risk 
to the launch complex is high, and the potential for launch delay is extremely high. 
The quality of design depends on the knowledge and experience of the design 
group. 

Component and subsystem testing cannot simulate all thermal, vibration, and 
transient loads of the total system. Fatigue failures, fracture mechanics, seal 
compression, material creep aspects of design, and various manufacturing issues 
are better understood today than previously, but various failure modes still plague 
even mature systems. All programs using cryogenic propellants have experienced 
serious leaks or component/line failures in early testing. Vehicle designs have fluid 
connections ranging in size from one-quarter inch diameter to approximately 
eighteen inches in diameter. The Saturn V launch vehicle had between four and 
five thousand connections, while the S-IVB stage, which had only one engine, had 
between four and five hundred connections. 

Propulsion system testing accomplishes many necessary functions such as 
resolving problems with the hazardous gas detection system used to monitor for 
safety; determining the overall leak characteristics of the vehicle through repeated 
exposure during loading and long duration firings, and identifying consistent 
"problem leakers" permitting special action such as changing seal material, 
increasing sealing load, and changing line supports. 

Short duration FRF type testing may reduce risks of vehicle and mission loss 
moderately. It does not influence launch delay risk. 

PQQQ Effect. The risk of an early catastrophic inflight failure due to POGO is 
judged to be moderate and loss of mission risk is high. Launch delay risk is judged 
to be moderate. Natural longitudinal deflection frequencies of the vehicle structure 
are predictable with current computer simulation programs and test data obtained 
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from independent structural test articles. Engine pump gains and thrust oscillations 
due to inlet pressure fluctuations can be determined by single engine testing which 
incorporates provisions for controlled pressure inputs/disturbances within the 
feedline upstream from the engine inlet. Complex computer simulations using 
noted inputs can be used to predict vehicle stability margins, although the accuracy 
of such predictions, and thus the acceptability, from a program standpoint is 
debatable. 

Testing of flight type hardware with feed system pulsing is a likely 
requirement. Structural system and propulsion system frequency reinforcement in 
the lower modes will likely require hardware inclusion to ensure safe vehicle 
operation. Functional aspects of such hardware systems also must be 
demonstrated prior to flight. Such developments would add significantly to launch 
delay risk and to vehicle and launch complex risk. Such testing should be 
conducted remote from the launch site. 

Thrust Vector Control dVd Performances . The risks of early catastrophic 
inflight and mission loss failures due to loss of TVC are judged to be low. This 
judgement is based on the assumption that TVC and avionic subsystem testing will 
be performed, that on-vehicle integrated testing and checkout will be performed 
without the engines firing, and that single engine testing with live TVC actuators will 
be performed. The remaining risk judgement is based on the fact that analysis 
would have to be used to verify that matching frequencies did not exist between the 
structure and TVC system and to verify that structural deflections did not allow 
nozzle collisions during startup and at high gimbal rates. The S-l stage structure 
had to be redesigned to decouple structure/TVC matching frequencies. 

Pressunzation System Performance. The risks of early catastrophic and 
mission loss failures due to pressurization system performance inadequacies are 
judged to be moderate and high respectively. This subject involves many 
disciplines requiring complex analyses such as feed system pressure loss, 
propellant heating during ground and flight including propellant stratification 
characteristics, the storage and heat sources for pressurant gasses, and time 
dependent pressurant requirements. 

The system also requires complex mechanical and electrical hardware which 
must function near flawlessly under severe thermal, pressure, and vibration 
environments. Failure of the system to function as designed may result in 
inadequate NPSP to engines (explosion potential), inadequate tank pressure for 
tank structural capability (tank structural failure) and/or excessive tank pressure 
requiring flight venting of propellant tanks (potential vehicle fire damage) if vented 
below critical altitude. 

Overall system complexity, considering the number of complex 
subsystems/components which must function as a unit and the physical number, 
scope, and complexity of analyses involved in sizing all the systems, is the basis for 
quantifying the risks. Independent component/subsystem development testing is 
expected to be part of any development program but is judged inadequate 
because of the limited simulation of such a complex system. Previous vehicle 
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designs clearly show this to be the most troublesome vehicle system. Supporting 
material is provided in several of the appendices 

Vehicle simulation computer analyses of required pressurant flow rate versus 
time, feed system pressure loss, heat inputs to propellants and resultant 
stratification, and other type analyses for Shuttle are mature (after an extensive 
ground test program and many flights) and are possibly adequate for new 
programs using similar tank configurations. However, these analytical approaches 
are not mature for significant departures in tank configuration, propellant type, and 
other potential variables. Missions/designs requiring multi engine start or start in 
earth orbit are additional complicating features and affect risk. 

Short duration FRF type testing provides some very valuable information and 
may reduce risk to some degree, however, needed answers to all requirements are 
not provided and the remaining risk is judged to be moderate. 

Propellant Mass Uncertainty. The risk of early catastrophic and mission loss 
failures due to launch with inadequate propellant mass aboard are considered 
minor and moderate respectively. Launch delay risk is judged to be extremely high 
and unaffected by an FRF type firing and the companion propellant loading test 
conducted late in the program at the launch site. 

Risk, as for pressurization, is based upon overall complexity of the operation 
and not on any single, technical issue. Involved are properly located sensors 
within propellant tanks, appropriate flow shields to avoid disturbing flow currents 
capable of adversely affecting sensor output, propellant temperature for 
determining density and controlling computer electronics, and calibration data to 
permit integration of vehicle sensors and the ground based control system. 
Propellant loading to acceptable accuracies for Space Shuttle, typical of any 
vehicle loading requirement, necessitated extensive testing on the MPTA. Data 
was collected on six different occasions with propellants aboard for a total time of 
thirty hours. Additional data were obtained for each vehicle loading. Vehicle 
instrumentation, in addition to flight instrumentation, is required to collect necessary 
data. 

Risk is relatively unaffected by vehicle configuration or propellants, although 
vehicles requiring orbital restart may have higher risk. 

On-board propellant mass at liftoff can be verified indirectly by data from initial 
flights if a performance penalty on these flights is acceptable to make ample 
allowance for loading inaccuracies, although such an approach may delay 
achieving vehicle operational readiness. Under these conditions the risk is judged 
to be minor, although launch delay risk remains high. 

Propellant Loading Procedures/Q oerations . The risk of damage to flight 
hardware and facility hardware due to loading procedural complexity, errors and 
hardware oversights is judged to be high. The risk of unacceptable launch delays, 
while these procedures are being refined and hardware changes are made, is 
judged to be extremely high. Even with the Saturn and Space Shuttle propulsion 
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system test programs, loading problems plagued the first few Shuttle launches. 
The resultant delays would have been worse without the system test data base. 

The high risk assessment is based on the fact that examples of damage to test 
hardware abound. The "close-call" the first time the external oxygen tank was 
drained at MPT due to excessive flow rates and pressure surges is an example. 
Basic tank structural or other deficiencies are frequent occurrences necessitating 
changes in some phase of vehicle operation to avoid cost increases and schedule 
delays. Such changes generally increase complexity and risk. Shuttle was no 
exception— tanks were loaded under pressure which was contrary to original 
design philosophy. Also, early in the program initial propellant quantities loaded 
aboard the vehicle were controlled by newly developed lower tank bulkhead 
thermal criteria. On the Saturn V S-ll stage and earlier stages, hardware damage 
at the launch site included destruction of liquid oxygen tank vortex devices and 
feedline inlet screens. These failures were extremely hazardous — exposing raw, 
torn aluminum to both liquid and gaseous oxygen. 

Clustered Engine Performance and Low Level P,ut Off Sensors Both 
evaluation criteria are judged to be minor in all risk categories except low level 
sensors for which launch delay risk is judged to be moderate. An FRF of short 
duration benefits only clustered engine performance as propellant levels prevent 
low level cutoff sensor activation. Increased numbers of flights, prior to achieving 
operational status, are likely for unmanned programs while the total operational 
concept is not feasible for manned flight programs. 

Clustered engine performance uncertainty can be verified in flight with minor 
risks, although acceptance of a performance penalty may be required. Concerns 
are feed system interactions and degradation of performance. 

Minor flight catastrophic and mission loss risks for low level cutoff sensors is 
because sensors are backup cutoff devices and other anomalies are required for 
these sensors to be needed. Later flight program anomalies may be expected to 
require cutoff sensors as payload demand decreases performance margins. No 
safe inflight data gathering effort for these sensors is known. Acceptance of 
identified risk assumes ample propellant allowance can be made on early flights 
and that flights are unmanned. 

Large vehicles usually have large diameter, long feedlines which contain 
large masses of propellant residuals if propellants are not burned until levels are 
well below the feedline inlet. Propellant levels within such feedlines vary rapidly 
with time, thus the controlling system must be fast response and dependable. For 
MPTA, extensive difficulties were experienced initially with the system and serious 
flight failures would have resulted had its use been required and had development 
testing not been performed. Technical issues involved sensor 
inadequacies/failures, circuitry inadequacies and sensor location problems. 

P r QPUlsiQP Performance Margin Uncertainties . Propulsion performance 
margin determination requires input from a relatively large number of 
subsystems/disciplines. Some of the more significant ones are: on-board 


2-7 



propellant mass at liftoff, propellant temperature profiles, feedline pressure drops, 
pressurization system dispersions, engine operating dispersions, mission 
dispersions, planned emergency operating requirements and dispersions, 
minimum engine net positive suction pressure (NPSP) requirements, volume of 
unusable propellants (residuals), vehicle mass dispersions, vehicle aerodynamic 
drag loss dispersions, guidance loss dispersions, and low level cutoff sensor 
performance characteristics. 

Of these parameters, onboard propellant mass at liftoff, propellant temperature 
profiles, feedline pressure drops, pressurization system performance, clustered 
engine operating performance, propellant residuals, and low level cutoff sensor 
characteristics are all verified during a propulsion system test program. Each of 
these subjects has been discussed in preceding paragraphs. 

The risk of early inflight catastrophic failure is judged to be minor, while risk for 
mission loss is judged to be high. Mission loss risk may be reduced to minor by 
conservatively loading propellants for early flights. Instrumentation, in addition to 
the flight measuring program, and more flights may be required prior to achieving 
operational status or manning. A short duration FRF is of limited value, providing 
data on only two of six parameters relating to propulsion system performance. 

Ename/Feed System Chill. An inadequately cooled engine and/or feed 
system usually results in engine failure to start and may result in engine damage. 
A booster type vehicle with engine start prior to vehicle liftoff can consider this a 
non-issue relative to flight catastrophe and mission loss risk. This is because the 
function is complete at engine ignition. The risk for launch delay, however, is high. 
Extensive chilldown development problems occurred during MPTA testing. Many 
development difficulties were also experienced on stages S-ll and S-IVB of Saturn 
V and the S-IV stage of Saturn I — all three having engine altitude start 
requirements. For that reason flight catastrophe and mission loss risk are judged to 
be moderate for vehicles with engine start at altitude and high for vehicles with 
engine start in earth orbit. 

System design depends heavily bn propellants, engine design, and vehicle 
mission. Vehicles with engine start at altitude generally continue propellant chill 
systems operation beyond liftoff and until engines are started. Vehicles which start 
in earth orbit experience fluid management problems due to the reduced gravity 
environment in addition to engine/feedline chill problems which are more severe 
because hardware is warmer and may be filled with vapor. Analytical methods for 
defining engine/feedline chill are available but are of little value without basic data 
to anchor the methods. Necessary data can be achieved during propellant loading 
tests. The short duration FRF type tests provides actual proof of proper chill and is 
beneficial. For orbital start requirements, analytical methods are more complex 
and are even less dependable. Special ground tests are necessary including 
engine start. Extensive analyses are then required to prove engine start in the 
orbital environment is likely. Assurance of orbital start does not exist. An orbital 
experiment with demonstrated engine start was required for Saturn V S-IVB. 
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Testing, analytical methods, and correlation of analysis and test data require 
significant time, thus for some vehicle configurations and missions sole 
dependency on late testing at the launch site as the only source for data may prove 
to be exceedingly costly. 

Tank Insulation. Flight catastrophe and mission loss risks are judged to be 
minor, while launch delay risk is high. A short FRF is beneficial but cannot be 
considered essential; however, more than one propellant loading test is essential 
to verify both thermal and structural performance. Instrumentation in excess of the 
normal flight measuring program is required to collect necessary data. 

Insulation usage is dependent upon propellant type, mission, and vehicle 
configuration. Hydrogen filled tanks require insulation, while it may be optional for 
oxygen tanks. Vehicle design may determine if tanks with RP-1 require insulation. 
Insulated tanks filled with cryogenics often experience some insulation 
debonding— both small and large areas. Some factors affecting debonding are 
tank surface preparation, insulation type, quality control exercised in application 
processes, and tank deflections. For the early flight vehicles for programs without a 
propulsion system test program, insulation debond areas may be identified during 
propellant loading tests and repaired prior to flight. This can be highly ineffective 
considering launch schedule. The propulsion system test vehicle at a remote site 
provides for many loadings/firings relatively early in a development program and is 
an ideal method to improve insulation systems prior to flight vehicle delivery and 
exposure to cryogenic temperatures. Other necessary data from the loading tests 
are insulation system total heat leak which affects pressurization system design 
and ullage venting. Data obtained from tests require processing and extensive 
analysis prior to vehicle flight. Other items of interest are heat shorts (deficiencies 
in tank insulation) which may be conducive to liquid air/nitrogen formation — safety. 

Analytical methods to predict insulation failures do not exist and possibly will 
never exist, thus testing is necessary. Heat input to propellants can be analytically 
determined but with significant inaccuracies, thus anchor points through testing are 
needed. If heat leak test data are unavailable, program continuation based on 
conservative designs are possible but can be costly in terms of weight, number of 
flights, and increased instrumentation. 

Hardware Thermal Control. Flight catastrophe and mission loss risk are 
judged to be minor, however, launch delay risks are high. A short FRF type firing 
demonstrates all equipment functions at temperatures prevailing at engine start. 
The propellant loading test and standby periods preparatory to engine start are of 
immense value. Temperature sensitive propulsion, electronics, and structural 
hardware have temperatures determined during loading tests and compartment 
gas purges adjusted in quantity, temperature, and exhaust location to bring 
hardware within desired operational limits. Thermal insulation may be applied to 
components, as may heater blankets. These activities generally require 
considerable time, more than one propellant loading and instrumentation not 
normally planned for flight. 
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Vehicles with altitude start requirements may use such temperature data plus 
analyses to determine thermally acceptable temperatures are available at engine 
start. For missions requiring engine start in orbit, dependent upon elapsed time in 
orbit before engine start, component thermal conditioning pre-launch is of no value. 
Thermal analyses must be performed on all equipment, and those which are 
thermally unacceptable must be heated by heater blankets or cooled by some cold 
plate type system. Special testing independent of propulsion system testing may 
be required. 

Stored Gas System . Flight catastrophe and mission loss risks are judged to 
be minor. Launch delay risk is. minor, and launch complex risk is moderate. This is 
a high pressure system used to store gas which is needed by other 
systems/hardware. Test objectives are to ensure structural adequacy, that the 
charging procedure is compatible with vehicle/facility countdown and required 
onboard mass of gas, that the distribution system includes necessary redundancy, 
and that appropriate operational instrumentation is provided and is functional. 
Most aspects of the system can be well analyzed, however, some test data is 
beneficial for verification. Data from propellant loading tests verify most aspects 
except structural adequacy in an actual firing environment and adequacy of the gas 
mass. A short FRF will demonstrate environmental adequacy and limited 
information on gas mass. 
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APPENDIX 3 


SPACE SHUTTLE MAIN PROPULSION SYSTEM 


Shuttle Overview 

The Space Shuttle is a reusable transportation system designed to transport 
people and equipment to earth orbit, to transfer payloads from one orbital position 
to another, and to return people and equipment to earth upon mission completion. 
Space Shuttle, propelled by a combination of liquid cryogenic propulsion and solid 
rocket propulsion systems, is comprised of three separate major elements which 
must function as a system. These elements are: an orbiter, which is the only 
element to reach earth orbit and includes personnel and cargo accommodations; 
an external tank containing necessary propellant for the liquid engines; and a solid 
rocket propulsive element providing lift capability during the initial two minutes of 
flight. Space Shuttle is shown on Figure 3-1. 

Liquid cryogenic propulsion, the subject of this report, is provided by 
components located on the external tank (ET) and orbiter. Three Space Shuttle 
main engines (SSMEs) are located on the orbiter as are portions of propellant 
delivery systems, pressurization and loading systems, thrust vector control system, 
and major control elements. The ET contains hydrogen and oxygen propellants, 
propellant fluid system lines connecting the tankage to the orbiter, portions of 
pressurization and loading systems, and a minimum of controls and valves. 

Liquid and solid propulsion systems are ignited prior to liftoff, and utilized in 
parallel during initial flight phases; both systems have nozzles which are gimbaled 
for thrust vector control. Solid rocket boosters (SRBs) are separated from the 
Shuttle approximately two minutes after liftoff, while the liquid system operates for 
an additional approximately six minutes. Prior to orbiter orbital insertion, the ET is 
separated from the vehicle. Neither liquid nor solid propellant systems are 
involved in orbiter retum-to-earth. 

The SRBs include parachutes for descent after separation and are recovered 
from the ocean for refurbishment and reuse on subsequent flights. The ET is 
expendable. 

Liquid Propulsion System Overview 

The orbiter-located SSMEs and liquid propulsion system hardware were 
designed for reuse. The expendable ET propulsion equipment was minimized and 
designed for minimizing cost. 

An extensive data base containing analytical procedures, hardware design 
practices, manufacturing practices, and development techniques was established 
during the Apollo program. Since most of the information contained in this data 
base was directly applicable to the Space Shuttle design, non-engine Shuttle 
hardware and systems were designed maximizing the use of this information. The 
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major new requirement imposed on the Space Shuttle was hardware reusability 
(55 flight capability). This requirement obviously necessitated some new 
technologies. 

The SSME was an advanced concept, high-performance engine requiring 
innovations in design practices, materials, manufacturing, and inspections. Reuse 
requirements further complicated the development program. 

The liquid propulsion system design for the Space Shuttle is shown 
schematically in Figure 3-2. Physical design of the ET and orbiter are shown in 
Figures 3-3 and 3-4, respectively, while Figure 3-5 shows the SSME fluid cycle. 
Approximately one and one half million pounds of liquid oxygen and one quarter 
million pounds of liquid hydrogen are carried by the ET. The three orbiter SSMEs 
are supplied with propellants from the ET through orbiter/ET disconnects located aft 
of the ET. SSME rated sea level thrust is 470,000 pounds, although the thrust is 
varied between 65 and 104 percent rated thrust during flight (109 percent in 
extreme emergencies). 

Liquid Propulsion Subsystems 

Liquid propulsion systems consist of numerous subsystems and many 
components which must function individually and collectively in an interactive 
environment. Major subsystems are described and discussed briefly in the 
following paragraphs. 

Propellant Delivery System. Principal features of the propellant delivery 
system are: 

• Fine mesh screens in each propellant tank at the entrance to each 17-inch 
diameter feedline 

• ET located long oxygen and short "siphon" configuration hydrogen 17-inch 
diameter feediines 

• ET/orbiter interface 17 : inch diameter quick disconnect and valving for each 
propellant 

• Orbiter-located 17-inch diameter feedlines connecting quick disconnects and 
the respective propellant manifold 

• Orbiter-located 12-inch diameter feedlines, three from each propellant manifold 
to 12-inch diameter prevalves-one prevalve per line-located immediately 
upstream of the inlet to each low pressure pump (six in all). 

• Orbiter-located 12-inch diameter lines between the prevalves and low pressure 
pump inlets for each propellant (6 in all). 

The 12-inch diameter feedlines have additional fine mesh screens located 
immediately upstream of each low pressure pump inlet to assure no engine 
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FI6URE3-2. SPACE SHUTTLE MAIN PROPULSION SYSTEM SCHEMATIC 
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FIGURE 3-5. SSME PROPELLANT SCHEMATIC 




damage from contamination. The feedlines use appropriate gimbal joints to assure 
required flexibility, and components use vacuum jacketed or foam insulation for 
thermal control purposes. One four-inch diameter line on the ET parallel with and 
connected to the oxygen supply line establishes a flow loop to maintain subcooled 
liquid oxygen in the feedline during prelaunch and prevents oxygen feedline 
geysering. An anti-geyser line, in which facility-supplied helium was injected to 
prevent flow interruptions, has subsequently been determined unnecessary and 
has been removed to save weight and cost although vehicle sensitivity to oxygen 
geysering is increased. 

Hydrogen Feedline/E noine Thermal Conditioning 

Acceptable engine start requires heat removal from rocket engine 
components so that sub-cooled propellants exist within the feedline at start 
command. The system accomplishing these objectives consists of: ( 1 ) a bypass 
line containing a valve and small electrically driven hydrogen pump about each 
hydrogen prevalve - one per engine: and (2) a hydrogen flow return line from each 
SSME hydrogen bleed valve to the ET hydrogen supply tank. 

Return lines from each SSME bleed valve are manifolded prior to crossing the 
orbiter/ET interface through the quick disconnect enroute to the ET hydrogen tank. 
A high point bleed line-another significant feature of the system-is connected at 
the hydrogen feedline high point and terminates within the hydrogen ground vent 
line. Valving for controlling flow in this line opens during tanking and closes 
immediately prior to engine start. Hydrogen recirculation system operation 
commences during propellant loading and terminates immediately prior to engine 
start when prevalves are opened. 

Performance verification objectives for this system are accomplished prior to 
engine ignition, and if properly conducted, do not entail significant program risk. 
While specific test objectives and related events from testing are reported in later 
sections of the report, it can be summarized here that testing has revealed marginal 
performance capability which necessitated procedural and limited hardware 
changes to achieve necessary performance. 

Qxvaen Feedline/Enoine Thermal Conditioninn 

Requirements for oxygen hardware conditioning are similar to those for 
hydrogen, although the approach for accomplishing hardware conditioning is 
different. Prevalves and engine bleed valves are opened during propellant loading 
to permit a regulated flow quantity to continually flow through the engines. Flows 
exiting the SSMEs are ducted to ground systems for disposal. To assure 
acceptable propellant quality within the feedline at engine start, oxygen bleed flow 
from the ET is initiated only five minutes prior to start. This oxygen quantity from the 
tank is considered in the oxygen tank loading manifest. 
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Hydroaen/Ox vaen Prop ellant Depletion Sensors 


Engine protection from propellant depletion is necessary to assure safe 
engine shutoff. Sensors located within and near the bottom of the hydrogen tank 
and within the oxygen suction lines accomplish this purpose. Sensors are located 
to protect engines and minimize the unusable propellants. Multi-sensors are used 
for both hydrogen and oxygen. 

Performance verification objectives are accomplished during hot firing and 
entail significant risks to engines and possibly vehicle and facility. Failure to satisfy 
required NPSP to engines for each propellant can damage the engine-possible 
pump explosion. Engine oxygen NPSP changes rapidly as the propellant tank is 
emptied. Insufficient hydrogen to an engine results in unacceptably high 
combustion gas temperatures which destroy hardware in milliseconds. 

Propellant Delivery Dynamics 

Interaction of vehicle feed system and engine flow disturbances with the 
vehicle structure can lead to devastating consequences. Closeness of the 
first/second mode structural frequencies to propulsion system frequency require 
inclusion of protective features-passive suppressors-which are integrated into the 
vehicle design. A suppressor is located between low and high pressure oxidizer 
pumps of each engine, charged initially with orbiter supplied helium, and with 
vaporized oxidizer from the heat exchangers during flight. Excessive suppressor 
pressurant is discharged into the single 17-inch diameter oxygen feedline near the 
orbiter/ET disconnect valve. Helium pressurant is substituted for oxidizer 
pressurant at shutdown. Care is exercised to assure the liquid gas interface of the 
suppressor is not broken. An approximate 25 percent shift in feedline frequency is 
attributed to the suppressor system. 

Required data are obtained during hot firings, and processes for acquiring 
data entail some risks to the vehicle and facility. A hydraulic driven pulsing device 
installed on the oxygen feedline inputs pressure pulse to the fluid at varying 
frequency and amplitude.. Accelerometers and pressure sensors, strategically 
located on feedlines and engine, measure responses which are then used with 
mathematics to predict structural stability characteristics of the vehicle. Other data 
are collected as appropriate to assess performance of designs which may be 
included to prevent the structural dynamic problem. Data are collected with varying 
propellant levels in tankage and with the suppressor system in both inactive and 
active modes. Numerous difficulties have been experienced in establishing testing 
conditions desired and in collecting data; however, these difficulties are largely 
non-flight hardware issues. 

Propellant Tank Pressurization 

SSME hydrogen and oxygen low pressure pumps require a minimum net positive 
suction pressure (NPSP) if acceptable start, operation and shutdown are to be 
achieved. Propellant tank ullage pressure is one of the controllable variables 
affecting NPSP. Ullage pressure is also needed for oxygen and hydrogen tank 
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structural stability during liftoff and flight. Systems have been designed to satisfy 
requirements for each propellant tank. Pressurization system principal features 
are: 

• Pressurant gas sources 

• Relatively small high pressure lines from pressurant sources to flow controlling 
modules 

• Modules for controlling flow 

• Lines from controlling modules to orbiter/ET quick disconnects and continuing 
lines to propellant tanks 

• Gas diffusing system within propellant tanks 

• Devices for sensing ullage pressures within tanks and for controlling flow 
control modules 

• Vent/relief valves for tanks 

• Ground-to-vehicle supply systems for pressurizing tanks 

Hydrogen and oxygen tank pressurization systems are similar in design, 
although the gas sources differ. Heated gaseous hydrogen (liquid hydrogen tank 
pressurant) is available from each SSME nozzle wall coolant flow. Heated 
gaseous oxygen (liquid oxygen tank pressurant) is available from each engine- 
mounted heat exchanger. A ground storage supply provides ambient helium gas 
for both tanks during prefiring-approximately the final three minutes prior to engine 
start. Systems use gimbal joints and hardware insulation as appropriate to assure 
structural capability and hardware operative ness. Tank pressurization systems are 
shown in Figures 3-6 and 3-7. 

Many specific objectives are included in system verification. The paramount 
objective, however, for the pre-firing pre-pressurization system and the 
pressurization system active during firings, is to maintain tank ullage pressures in 
both hydrogen and oxygen tanks within specified control bands for all operational 
phases and potential failure modes. The original designed system has met 
requirements, although numerous problems have occurred relative to control 
module orifice sizing, control valve sluggishness in operations, oxygen heat 
exchanger internal coil pressures for some conditions less than the fuel rich hot 
gas flow external to coils, software changes relating to pre-pressurization control 
and other areas. 

Propellant Loading 

The Space Shuttle propellant delivery systems, previously described, are 
used for both hydrogen and oxygen propellant loading. Additional required 
hardware for each propellant is limited to: (1) a 12-inch diameter line from the 
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orbiter-located manifold to the vehicle skin; (2) two series valves in this line; and 
(3) an orbiter-to-ground quick disconnect valve. Critical to the loading process is 
operational instrumentation - liquid level sensors within tanks for managing 
operations; selective temperatures and pressures measured within tankage, vent 
systems, propellant delivery systems, and ground located hardware for fluid 
condition monitoring. 

Aside from undesirable/unsafe aspects of hydrogen leaks during loading, the 
physical process of transferring hydrogen from ground systems to the Space 
Shuttle is simple relative to oxygen loading. Vehicle hardware damage attributable 
to slugging oxygen flow during facilityArehicle hardware chilldown is a possibility. 
Fluid geysering and resultant serious damage to hardware is possible once 
oxygen commences collecting in facility vertical lines enroute to the vehicle and 
within engine and vehicle lines. Thorough procedures are essential for these 
operations. Many procedures developed prior to testing have been amended; 
some were totally rewritten, based on new information, and all were verified during 
the many months of testing. The many test requirements are defined in Table 3*1 
and cover all aspects of normal and contingency operations. 

Vehicle hardware used for propellant loading is used also for propellant 
removal. 

Propellant Loading At Elevated Tan k Pressure 

ET design philosophy was based on: (1) hydrogen and oxygen tanks being 
capable of "free standing" on the launch pad and; (2) no required internal pressure 
during propellant loading and standby operations with propellant aboard. This 
philosophy changed during the propulsion system test program, and requirements, 
which varied with time, were imposed for internal tank pressures during propellant 
loading and some standby operations prior to and after firings. Vehicle vent valve 
cycling to control internal tank ullage pressure within specified limits during 
propellant loading and post loading operations was investigated, selected as the 
preferred approach and demonstrated. 

Other requirements restricting propellant levels during loading to satisfy 
hardware thermal limits were also imposed. Such requirements were managed by 
procedures. 

Late recognition of these requirements necessitated total development of 
concept, necessary engineering, and procedures after system testing had 
commenced. Primary concern relative to control method implementation was tank 
overstress and potential blowup. Considerations of both normal and contingency 
operations were required for not only ullage pressure control but for other 
disciplines such as loading to assure geysering did not occur. 

Propellant Loading Instrumentation and Software 

SSME oxidize r-to-fuel consumption is 6:1 and has been essentially constant 
during missions. Propellant quantities loaded were thus based on engine 
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consumption requirements plus performance reserves and unusable propellants. 
To facilitate loading to specified requirements, propellant level sensors are located 
at designated locations in each tank. Multiple sensors are located at the 
designated 100 percent propellant level and other levels in close proximity. 
Sensors are also located within tanks to provide propellant levels during loading 
and prevent tank overfill. 

Flight mass is achieved when monitored sensor/sensors register wet a 
specified percent of the time-15 to 75 percent-continuously under specified 
conditions. Loading activity at KSC is computer controlled and major parts of 
software development are critically dependent upon propellant loading sensor data 
collected during propulsion system testing. 

This complex area resulted in many surprising findings, thus test requirement 
changes were necessary as events unfolded. Data collection time exceeded that 
for any test requirement. Unexpected propellant flow currents in tankage adversely 
affected sensors and required sensor shielding. Initially available electronics for 
automated loading control were inadequate and required replacement; software 
changes for hardware compatibility were essential; and necessary input data were 
collected during hours of testing devoted to this one subject. 

Oxvoen/Hvdroaen Feedli ne Safinps 

Propellant delivery systems on the orbiter plus parts of the fill-and-drain 
systems (both hydrogen and oxygen) are filled with propellants. Hardware sating 
after main engines shutoff, and ET/orbiter separation is necessary. Hydrogen fill- 
and-drain valves and prevalves are opened, and the system is vented to vacuum. 
The oxygen prevalve and main engine oxygen valve are opened and the oxygen 
system vented to vacuum through engine nozzles. Both systems are then purged 
with helium from vehicle storage bottles. Appropriate valving is then closed 
preparatory to orbiter reentry at some later date. Test objectives for this issue and 
the following issue, retum-to-launch-site (RTLS) dump, are not unique but were 
necessary to verify prepared procedures with particular emphasis on the time line. 

RTLS Dump System 

An aborted Shuttle mission with the orbiter returning to the launch site results 
in propellant delivery systems full of propellants. Disposal of hydrogen is most 
important prior to re-entering earth's atmosphere. Opening RTLS valves permits 
hydrogen propellant to escape. System purging with ambient temperature helium 
further safes the system. 

Aft Compartment Safing 

The aft compartment of the orbiter, between bulkhead 1307 and the aft heat 
shield, contains three SSMEs (excluding nozzles), total propellant delivery systems 
located on the orbiter, propellant fill-and-drain systems, SSME control electronics, 
vehicle propulsion system electronics/instrumentation, other propulsion system 
equipment, and a gas distribution system for inerting and thermal conditioning 
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compartment and equipment. Many low and high pressure pipe connections for 
both oxygen and hydrogen systems are sources for leaks. 

The compartment inerting and thermal control system consists of numerous 
nozzles for distributing a ground supplied heated nitrogen flow. Gas sensing 
probes within the compartment alternately provide compartment gas samples for 
real-time analysis and test operation decisions regarding safety. Strategically 
located vacuum sample bottles throughout the compartment obtain gas samples 
during simulated flight phases for postflight analysis. For safety enhancement, 
propulsion system test hardware uses non-heated nitrogen purges of significantly 
greater quantity than the heated nitrogen purge used on both the flight and test 
article. Also, fast response hydrogen sampling devices are located within the aft 
compartment of the test article, as are fire detection sensors. Other compartments 
of the vehicle such as the ET intertank use somewhat similar inerting, thermal 
control and monitoring systems. 

Miscellaneous Vehicle Systems 

Numerous systems such as the hydraulic system for vehicle control and 
systems for tank inerting prior to propellant loading have not been discussed. 
Proper operation of each system collectively with other systems is essential for 
success. Previous discussions of systems are believed to suffice for portraying 
insight into Space Shuttle and the propulsion system test program. 

Space Shuttle Main Engine 

The SSME is a high performance, high technology engine with reuse 
capability. None of these characteristics impose significant complexity to design or 
operating features of the vehicle propulsion system. It merely implies a compact, 
high performance thrust package for vehicle use. Such an engine design, 
however, generally requires longer development time and more testing to reach 
maturity, and if used prior to achieving maturity, vehicle risks occur and test 
program delays are likely. The SSME was not adequately mature for 
approximately the first half of the propulsion system test program. 

The SSME uses a staged combustion cycle in which propellants are partially 
burned at low mixture ratio, high pressure, and relatively low temperature in the 
preburners and then completely burned in the main combustion chamber. The 
SSME flow schematic is shown in Figure 3-5. The propellant system uses four 
turbopumps. The two low pressure turbopumps operate at relatively low NPSP to 
permit low pressures in the vehicle tanks. The function of these pumps is to 
provide sufficient pressure at the inlets of the high pressure turbopumps to permit 
them to operate at high speeds. Approximately 75 percent of the flow from the high 
pressure oxidizer turbopump (HPOTP) goes directly to the main combustion 
chamber. Approximately 10 percent is directed to the preburner pump, which 
raises the pressure to that required by the preburners. Small quantities are bled 
through the heat exchanger for oxidizer tank pressurization and POGO 
suppression pressure. The balance of the oxidizer drives the turbine powering the 
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low pressure oxidizer turbopump (LPOTP) and is then recirculated to the inlet of the 
HPOTP. 

Approximately 20 percent of the high pressure fuel turbopump (HPFTP) 
discharge flow is used to cool the main combustion chamber (MCC), drive the low 
pressure fuel turbopump turbine, cool the hot-gas manifold and injector, and 
provide fuel tank pressurant. The remaining fuel is first used to cool the nozzle, 
then supply the preburners. 

The hydrogen-rich steam generated by the fuel and oxidizer preburners first 
drives the high-pressure pump turbines, then flows to the main injector where it is 
mixed with additional oxidizer and fuel and injected into the main combustion 
chamber. 

The main injector is baffled, coaxial-element injector, having dual faceplates 
that are transpiration-cooled by gaseous hydrogen. The gimbal bearing is bolted 
to the main injector and dome assembly and is the thrust interface between the 
engine and vehicle. It also enables the engine to be gimballed to provide pitch, 
yaw, and roll control. The MCC consists of an internal coolant liner and an external 
structural jacket. The main combustion chamber operates near 3300 PSI and 
experiences exceedingly high wall heat transfer rates. Thus to avoid burn through, 
a unique design is necessary. To enhance heat transfer, the chamber is made of 
copper alloy which is cooled regeneratively with hydrogen flowing through milled 
axial coolant channels. The nozzle is bolted to the MCC and is constructed of 
tapered tubes reinforced by a structural jacket with insulated hatbands. The tubes 
provide an up-pass fuel coolant circuit that is supplied with hydrogen through three 
down-pass transfer ducts connected to the aft inlet manifold. The nozzle has an 
expansion ratio of 77.5, although during development, two engine nozzle 
configurations were utilized-flight nozzle configuration with large area ratio and 
non-flight configuration with much smaller area ratio. 

Commands to and within engines are controlled by a separate controller for 
each engine. To work effectively as an engine system and as a subsystem within 
Space Shuttle, other significant engine components are required as control valves, 
sensors of all types (temperature, pressure, accelerometers), hydraulic actuators, 
and ignition systems. 

SHUTTLE PROPULSION SYSTEM TEST OBJECTIVES 

Propulsion system test objectives were initially developed to assure inclusion 
of capabilities essential for satisfying vehicle, engine, facility, and GSE needs. The 
broad test objectives follow: 

• Determine structural acceptability of engines in the propulsion system test 
environment 

• Determine functiona l capability of engines in the propulsion system test 
environment 


3-15 



Validate engine-imposed vehicle design requirements 
• Determine engine propellant leakage integrity 


Validate structural integrity of major elements (ET, Orbiter, SRB) and the 
interactive loads between major elements 


Validate structural integrity of propulsion systems of individual elements to the 
interacting environments 


Validate the functional capabilities of propulsion system 
components/subsystems in the propulsion system environment 

Validate the functional capability of electrical hardware, computer control 
system/software with vehicle/propulsion system environments 

Validate vehicle/propulsion system imposed engine requirements 

• Determine propulsion system leak integrity 

• Determine vehicle external design environments 

Determine functional compatibility of the vehicle structure, fluid, electrical 
hydraulic, and software systems with the ground/GSE interfacing systems. 

These broad objectives were amended as appropriate and specific test 
requirements to be satisfied during propulsion system testing were developed 
Table 3-1 is a total list (approximately 300) of test requirements, including initiai 
requirements and others added throughout the program. The initial requirements 
approximately 200, were carefully integrated and scheduled to form a test program! 
Twelve hot firings of varying time durations from a few seconds to approximately 
550 seconds, one non-firing propellant loading test, and two structural tests 
(resonant survey) were identified to be necessary. 

Composition of each of the twelve hot firings actually conducted during 
propulsion system testing bears little resemblance to initially planned tests 
because: (1) hardware available for use largely controlled specific test 

requirements; (2) testing delays created immediate data needs to be satisfied 
^erever possible to minimize program impacts and; (3) test requirements were 
added to the program. Although test requirements were altered (shifted) 
significantly between tests, each test requirement of Table 3-1 was totally or 

partially satisfied (all satisfied to an acceptable level) in the propulsion system test 
program. 


Additional test requirements, which were identified as testing progressed and 
integrated into the program, were in many cases crucial to Space Shuttle 
development/verification. These test requirements, involving both hot firings and 
non-hot firing type tests, resulted from oversight during the initial planning period 
design changes to the vehicle/facility from earlier periods, failure of 
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TABLE 3-1. SPACE SHUTTLE PROPULSION SYSTEM TEST REQUIREMENTS 
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TABLE 3-1. SPACE SHUTTLE PROPULSION SYSTEM TFST REQUIREMENTS 
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TABLE 3-1. SPACE SHUTTLE PROPULSION SYSTEM TEST REQUIREMENTS 
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TABLE 3-1. SPACE SHUTTLE PROPULSION SYSTEM TEST REQUIREMENTS 





ng transients; 


emonstrat e effects of POGO oscl 


ents. 


JmUH iMiIHITF M 


E/Orblter 


erface. 


ne cu 


al laat e ECO sensor system, cutoff delay. resldul esT 
revalve relief function w ith no close 
and closed commands 


covered. 


.iu Lnfc rrepressurization System Pe rf ormance 
verification 


ame as dis cussed earlier for 




[I'll' i 


errormance. 


■ _ ■ 

MLilj jEEiLL«h aM'i-fPliU4-«^.i ll , Tnnn nijr».-d 

BjEinBr miim ffrr'M 
rnn— 


rocedures c 


nts tor 


wo-nour opera 


auncn countdown. 


lhi uroner/GSE carrier plate 
effectiveness " 


etermlne e 


unpressur 



MTil 1 1 

Hn w s*nn 


cryogenic gas n 
replenish. 


ty of inboard rap va lve. 

erfornTa countdown recycle fr om f-4.3 sec 
and replenish LH2 to 1001 



ack pressure unde 


ring chilidown. fast fill. anTT 


3-20 













































TABLE 3-1. SPACE SHUTTLE PROPULSION SYSTEM TEST REQUIREMENTS 
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TABLE 3-1. SPACE SHUTTLE PROPULSION SYSTEM TEST REQUIREMENTS 
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hardware/procedures to yield expected results, and hardware/system 
improvements. Requirements for non-firing type data were so great that such data 
were collected for most scheduled hot firing tests during a time interval between 
propellant loading and actual hot firing. The following are some of the special tests 
which were conducted: 

• SSME cold gimballing 

• Liquid oxygen tank pressure undershoot 

• Liquid hydrogen tank vent flow rate 

• Calibration of 100 percent propellant loading sensors 

• Evaluation of propellant temperature stratification 

• Helium bottles blow down 

• Liquid oxygen/liquid hydrogen tank self pressurization 

Two examples of "add on" test requirements are: (1) anti-geyser line removal 
and (2) operation of hydrogen recirculation pumps at increased speed-500 Hertz 
versus the normal 400 Hertz power frequency. 

Data collected with the anti-geyser line for preventing fluid geysering provided 
clues that safe operation may be possible without the anti-geyser line. Line 
removal would save money and vehicle weight. Deliberate data 
evaluation/analysis and careful planning were necessary because of serious safety 
implications. A series of tests were planned and successfully conducted, thus 
proving the line could be removed. Today’s Space Shuttle does not use this line. 

The recirculation pumps, one per engine, circulate fluid through the engine, 
liquid hydrogen hardware, and feedlines prior to engine start command for 
purposes of thermal conditioning. Serious difficulties were experienced in early 
testing relative to an imbalance between heat input to the hardware and pump 
capacity. Doubts regarding pump flow/delta pressure adequacy existed; however, 
pump replacements without program impact were not possible. Increased pump 
speed offered increased flow quantity and pressure rise and consequently could 
resolve a potentially marginal condition without schedule impact. The test was 
conducted and system performance established for future use if necessary. 

MAIN PROPULSION TEST ACCOMPLISHMENTS 

This section presents a listing and discussion of: important issues 

representing accomplishments of the program; unworkable designs/procedures 
which were made workable by changes and then verified; workable 
designs/procedures for which adjustments to achieve acceptance were initially 
anticipated and were accomplished; improved hardware for performance, safety; 
and other issues. The listing cannot be considered complete and cannot be 
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compared line by line with test requirements of Table 3-1, which includes initial 
requirements plus requirements added during the program. Nevertheless, this 
specific listing qualitatively demonstrates the worthiness of propulsion system test 
programs for complex vehicle designs. Twenty-five percent of the listing is 
estimated to have resulted from "add on" test requirements during the test program. 
This statistic is most important and demonstrates the knowledge and discipline to 
prevent oversights and to enable the necessary design insight. Complex 
development programs without a flexible propulsion system test can expect major 
unpleasant technical, schedule and cost surprises. 

To enhance the understanding of the accomplishments, issues with some 
similarity have been grouped under arbitrary titles as follows: 

• Liquid Hydrogen Recirculation Pump Operational Procedures/Hardware 
Changes 

• Liquid Oxygen Engine Pump Chill Down System and Oxygen Tank Loading 

• Liquid Hydrogen Tank Loading 

• Firing Initiation 

• Firing Termination 

• Miscellaneous 

To further enhance insight, each individual issue has been related according to two 
other factors as indicated in parentheses after each issue title: (1) classification of 
the issue relative to consequences— -catastrophic; unworkable; workable with 
adjustments, as was originally anticipated; and product improvement, with 
implementation being optional; and (2) time phasing of operation in which the 
issue occurs — preflight or flight. Table 3-2 is repeated from the main body of the 
report and provides a summary as to distribution of issues according to identified 
categories. 

Table 3-2. Reported Propulsion System Testing Accomplishments Classified by 
Consequence and Time Phased — MPT A 


Stage 

Catastrophe 

Unworkable 

WM 

5531 1 

Improvement 

Total 

Per 

Stage 

Flight 

Prefliaht 

Flight 

Preflight 

Flight 

Preflight 

liiTml 

Preflight 
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3 

3 
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6 
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Li quid Hydrogen Recirculation Pump Operati o nal Procedures/Hardware r,hanflP<j 

H i qfl Point . Bleed Sequencing/Line Back Pressure (unworkable, nmflinht^ 
Hydrogen gas, created within the propellant delivery system during periods of zero 
or low flow rates, collects at the high point of the 17-inch feedline— immediately 
downstream of the ET/Orbiter disconnect. A 3/4 inch diameter line from this 
location, through the Orbiter/ground interface and connecting with the facility vent 
line, permits removal of this collecting gas. In order to conserve liquid hydrogen 
propellant in the system, a programmed mode of operation was adopted for the 
control valve within this line. The valve would open prior to recirculation pump start 
and close prior to tank pressurization preparatory to engine start. Unfortunately 
excessive delivery system heat leak and other factors resulted in a large gas 
volume which the high point bleed could not remove; thus recirculation pumps 
would not operate (due to cavitation) and engine start w r -: impossible. Procedures 
were modified to open the high point bleed line valve curing propellant loading 
prior to formation of the large gas volume. 

High back-pressure at the vent line exit also reduced line flow potential thus 
relocation of the line exit was required. Incorporation of both hardware and 
procedural changes led to successful removal of the gas volume, successful 
operation of hydrogen recirculation pumps, and acceptable propellant 
temperatures at SSME pump inlets and throughout the feedlines. Successful 
operation was demonstrated on all subsequent firings of the propulsion system. 

Eropellant Loading Temperature (un w orkable, prefiinhtt initial vehicle 
propellant loading operations used propellants from supply barges. Supplied 
propellants were anticipated to be approximately the same quality as supplied from 
storage tanks at KSC. Vehicle liquid hydrogen recirculation pumps, exposed 
almost directly to this supplied/incoming flow, cavitated, thus revealing the 
influence of incoming liquid hydrogen temperature on pump performance A 
procedural change requiring propellant supply barge venting to reduce liquid 
hydrogen temperature several hours prior to planned vehicle propellant loading 
resolved the problem and provided valuable insight for necessary KSC operations. 

5QQ Hertz Recirculation Power (workabl e - mod expected, oref light) . It was 
concluded that liquid hydrogen propellant delivery system thermal conditioning 
(recirculation pump operation, high point bleed operation, and system heat leak) 
was sensitive to a number of variables and that the current design was marginally 
acceptable. Normal pump operation used a 400 hertz power supply; however, all 
involved hardware could accommodate operation with 500 hertz power. Operation 
at 500 hertz would increase recirculation pump flow and pressure rise capabilities, 
thus increasing system margin. A contingency test was performed successfully! 
and a performance data base was developed for future use as appropriate. 

. Restart Procedure (improvement, prefliaht) . Possible events can result in 
liquid hydrogen recirculation pump cutoff and consequently require restart at some 
later time. Procedures for reinitiating recirculation pump start existed and were 
proven acceptable during testing; however, the procedures were unduly complex. 
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A procedure which is simpler and requires less time was developed and verified to 
be acceptable. 

Liquid Oxygen Engine Pump Chilldown System and Oxygen Tank Loading 

Liquid Qxvqen Drain Back Time (workable • mod, expected. orefliahtL The 
major part of liquid oxygen replenish flow does not progress into the ET liquid 
oxygen tank, but is diverted from the orbiter liquid oxygen manifold into the three 
12-inch diameter feedlines as engine pump/equipment chilldown flow. Liquid 
oxygen within the propellant delivery system upstream of the orbiter manifold is 
virtually stagnant, relatively warm, and will not satisfy engine start requirements. 
Prior to engine firing, the feedline liquid oxygen is exchanged by colder liquid 
oxygen from the ET liquid oxygen tank. This is accomplished by terminating 
replenish and continuing engine chill flow with all liquid oxygen flow now supplied 
from the ET liquid oxygen tank. Propellant conditions within the feedline and 
engine thermal conditions were investigated for various times of liquid oxygen 
drainback from the ET. The optimum time of nine minutes was selected and 
procedures finalized. (Drainback time was driven to five minutes by other 
requirements well into the flight program.) The ET liquid oxygen loading manifest 
accommodates propellant drainback quantities. The provided data base allows 
flexibility in adjusting the liquid oxygen load at KSC. 

Inertino Purge Procedures (workable - mod, expected, oreflioht). Propellant 
tanks, valving, and lines require inerting prior to exposure to propellants. A 
continuous flow procedure is used where an inert gas is introduced into the tank 
simultaneously with expulsion from tankage of a similar quantity of gas. This 
process continues until strategically located instruments are recording safe 
concentration levels within tankage. Humidity levels are also evaluated. Testing to 
minimize time required for inerting and inert gas helium quantities required were 
conducted and procedures were finalized. 

Facilitv/Vehicle Chill (workable - mo d, expected. prefliohtL Transition of 
facility liquid oxygen supply lines from ambient temperature to liquid oxygen 
temperature is a critical phase relative to avoiding vehicle hardware damage. The 
fluid dynamics encountered as fluid changes state in the transfer lines can result in 
"slugging" which is destructive to vehicle hardware. While test site and launch site 
hardware differ in many respects, carefully prepared procedures are necessary for 
each, and experience from one site benefits the other site. For example, the ET 
was one of a limited number of stages loaded at the launch site which did not 
experience hardware damage, due to such experience from test sites. 

Propellant Loading Temperature and Slow Fill ( catastrophic, prefliohtl As 
discussed for liquid hydrogen earlier, liquid oxygen temperatures from supply 
barges were unacceptably warm. The relatively warm liquid oxygen created the 
potential for a geyser which could result in devastating consequences. A 
procedural change to vent supply barges several hours prior to vehicle loading 
was implemented, thus reducing the temperature of supplied propellant. Liquid 
oxygen geysering can also result from the transfer of stored engine thermal energy 
to liquid oxygen within the propellant delivery system. The engine liquid oxygen 
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c u .ll flow is beneficial for removing engine thermal energy. Procedural changes 
were made which prevented propellant loading beyond vehicle station 1616 prior 
to liquid oxygen chill flow expelling propellant warmer than -281*F through the 
engine bleed valve. This is accomplished by restricting slow fill rate to 75 gpm until 
the necessary temperature is achieved. 

Tank Loading Under Pressure (unwo rkable, preflightt . This subject applies to 
both liquid oxygen and liquid hydrogen. External tank structural deficiencies 
required positive internal pressure during loading of propellant tanks. This was 
contrary to initial design requirements and required changes in the loading method 
and procedures. The method adopted was to control tank pressure by cycling 
vehicle vent valves, a method not previously used and inherently introducing risk. 
The approach was explored and thoroughly developed, and procedures were 
established. Liquid oxygen replenish rates to ensure proper flight levels were also 
accomplished at elevated tank pressures while cycling vent valves. The ET 
structural capabilities changed frequently necessitating changes to the procedure. 
Tank redesign to preclude this condition remains impractical, thus the procedures 
are permanent. 

Closed Loop Propellant Level Control [ unwor kable, prefliohtL Space Shuttle 
propellant loading at KSC is automated, while at the propulsion system test site, 
only replenish/topping phases were planned to be automated. Extensive data 
collection was necessary to properly implement automation. Initial test results from 
the test site demonstrated that the control electronics could not satisfy requirements 
and that replacement of control electronics was required. Similar changes to the 
launch processing system (LPS) at KSC were required. Availability of replacement 
control electronics resulted in extensive testing to collect necessary data for total 
system development and verification. 

Re-lnitiatina Replenish (unworkab le, preflightl . Contingency planning 
required procedures for replenish flow termination and subsequent re-initiation. 
Initial procedures for liquid oxygen resulted in a large pressure spike when the fill- 
and-drain valves were opened to re-initiate replenish. The cause was release of 
stored energy from self-pressurized, trapped liquid oxygen in the facility lines. New 
procedures to eliminate/reduce the pressure spike were developed and verified for 
use at both test and launch sites. 

ET Oxvaen Off Loading (catastrophic, preflightl. Procedures developed for off- 
loading liquid oxygen from vehicle to facility resulted in unacceptable initial flow 
rates within Orbiter hardware and unacceptable pressure spikes in facility 
hardware. An orifice was installed at the Orbiter/fadlity interface to reduce both the 
transient and steady state flow rate. Procedures were modified to reduce facility 
surge pressure. 

Anti-Gevser Line Removed (improvement, preflightl . Anti-geyser line removal 
increased payload capability and afforded significant cost savings. Important 
development work using subsystem test hardware for the initial configuration led to 
an understanding of system performance, later verified on MPTA, and the operating 
margin. From this work, the idea for removing the anti-geyser line was conceived. 
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The concept was demonstrated on MPTA and later was accepted. Oxygen 
geysering is a critical safety issue, thus procedures must be carefully developed 
and verified for all normal and contingency operating modes. 

Hydrogen Tank Loading 

Topping Flow Rate (work able - mod, expected, orefliahtl . Orbiter lines were 
shown by test to have higher pressure loss than predicted. An increase in interface 
pressure was required to achieve the ICD topping flow rate. 

Tank Thermal/Tank Loading Under Pressure (unworkable, preflioht) . The 
liquid hydrogen tank, similar to the liquid oxygen tank, required internal pressure 
during loading and with propellant on board. Vent valve cycling was again used to 
satisfy the requirement. An additional requirement related tank propellant level to 
bulkhead temperature during initial loading phases. Techniques for accomplishing 
this later requirement were developed. Procedures for both requirements were 
developed and verified. Since launch and test site facilities are not identical, 
similar procedures were developed for KSC. 

Firing Initiation 

Engine Ready Logic Changes (unworkable, preflight) . Initially "engine ready" 
activity completion, necessary for engine start, was accomplished immediately prior 
to start command, thus causing its failure to result in recycling the countdown, 
which was undesirable. To minimize roll back, engine ready was revised with 
completion planned immediately following ET prepressurization. This provided the 
flexibility to hold the countdown for strategizing/action without recycling. 
Procedures were amended and satisfactory operation was demonstrated many 
times. 

Countdown Interlock Reduction (unworkable, orefliahti. Difficulty in achieving 
necessary conditions for a successful countdown resulted in reassessment of 
interlocks. The number of interlocks was reduced and many were simplified to 
enhance launch probability. 

Aft Fuselage Inerting /Thermal Control (workable - mod, expected. preflioht). 
Two objectives were considered in this development: (1) assuring that 

components, both propulsion and electrical, do not become excessively hot or cold 
during prefiring and firing periods; and (2) assuring that gas sampling devices are 
properly located to detect gas leaks (primarily preflight). Variables involved are 
quantity, temperature, discharge location, and direction or purge gases and gas 
sampling probe locations. Gas sampling systems for flight were developed. With a 
new vehicle design, particularly if several verification/development firings are to be 
made, a higher than normal purge system capability is necessary for safety. These 
systems have been instrumental in preventing total stage/facility loss. All above 
aspects were an important part of the program, and launch redlines and 
procedures were developed accordingly. 
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Eeedline Screens Unworkable, prefliohtL Oxygen and hydrogen feedline 
screens located near low pressure (oxygen and hydrogen) engine pump inlets 
provide protection from foreign particles. Current usage on Shuttle is a result of the 
test program. Loss of needle bearings from the oxygen drain valve and distribution 
of these bearings throughout the hydrogen and oxygen systems was the motivator. 
Screen usage affected available engine NPSP, which was marginal; thus the 
design approach was critical. Valve redesign was necessary; a replacement spool 
piece was required to permit testing to continue. 

Hydrogen Pressurant Diffuser Structural Failure s (unworkable. preflioht/fliahtL 
The pressurant diffuser, located internal to the liquid hydrogen tank for distributing 
pressurant gas throughout the tank ullage and achieving required tank pressures 
and minimizing pressurant gas weight, structurally failed as did several improved 
designs. Flow induced vibration created by incoming high velocity pressurant gas 
resulted in metal fatigue. Change of material from aluminum to steel resolved the 
issue. Component testing had not experienced this difficulty although testing was 
incomplete. 

Qxvoen Tank Prepressurization Overs hoot (unworkable, flight) . Liquid oxygen 
tank ullage pressure exceeded the allowable control band during 
prepressurization. The pressurizing gas is helium which is supplied from the 
facility. Flow capability is regulated by appropriate facility valve, and orifice and ET 
located pressure sensors provide necessary flow control. The problem was 
resolved by eliminating a short delay in the SATS program and removing the 
helium supply valve actuator orifices. Subsequently, ullage pressure requirement 
was maintained within the control band. 

Pressure Transducer Dr ift (unworkable. prefliahtT Pressure transducers 
mounted to or in close proximity to hardware containing cryogenic fluids yielded 
inaccurate pressure readings. Some measurements were crucial for firing initiation 
and safe operations. It was necessary to relocate transducers which were used for 
establishing engine ready. Other transducers were removed from the control logic 
while others were insulated to minimize drift. 

ET Pressure Transducer Failure (unworkable, flight) . Flow induced vibrations, 
created by propellant tank vent valve cycling required to maintain a positive tank 
pressure for structural considerations, resulted in fatiguing the poteniometer-to- 
wiper interface of the pressure transducer. Transducer redesign was necessary. 
System environments identify problems which otherwise are not identified because 
testing is regulated by input requirements, which frequently are limited due to lack 
of system knowledge. 

PQGO Accumulator Gas Collapse fu nworkable. oreflightL An accumulator 
containing both liquid and gaseous oxygen located on the SSMEs between the 
low pressure and high pressure pumps changes response frequencies of the 
propulsion system. During engine start, the accumulator ullage gas, oxygen, 
collapsed and pressure spikes in the upstream feedline were observed. 
Incorporation of a helium gas precharge into the accumulator prior to engine start 
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resolved the problem. A helium precharge was incorporated into the normal 
engine start sequence. 

Feed System Stability (workable - mod, expected, flight) . POGO (interaction of 
vehicle structure with dynamically created disturbances occurring within the 
oxygen feedline/engine system) is a major concern for vehicle designers. 
Complicated math models necessary to establish vehicle stability margin prior to 
vehicle flight require input data which are obtained from special ground testing 
utilizing flight configuration hardware. Extensive data of the oxygen feed 
system/engine were obtained with dynamic disturbances established by applying 
pressure pulses of varying magnitude, frequency, and mode shape upstream of the 
pump inlet. This was accomplished both with and without hardware which was 
provided for preventing dynamic problems. Quantifying safety margins was vital 
data for the program. 

Engine Start Positioning (improvement, preflight) . Unknown magnitude of 
sideloads during the SSME start transient required flared outward positioning of 
engine nozzles to provide maximum clearance in the event the TVC relief valve 
relieved and the engine moved. Testing demonstrated engines could be safely 
started in the preferred null position. Procedures were changed to start in the null 
position. 

Aft Heat Shield Over-Pressure (unworkable, oreflioht) . Hydrogen gas exits 
SSME nozzles for a brief time period immediately prior to engine start. Ignition of 
hydrogen, which may accumulate in the vehicle base under some conditions, can 
result in unacceptable pressure spikes at engine ignition. A system to prevent 
accumulation by burning hydrogen as it exits SSME nozzles can prevent pressure 
spikes from occurring. Propulsion system testing confirmed that a burn-off system 
was required. A burn-off system was designed for the launch site and was verified 
during propulsion system testing. 

ET/Orbiter Qxvoen Propellant Disconnec t (catastrophic, unworkable. 
nreflight/flightt . This valve is located immediately downstream of a 90 degree 
elbow and near the aft end of the ET. It is a 17-inch diameter quick disconnect (two 
valve butterfly - poppet concept). The turning flow forces generated by the close 
proximity of the upstream elbow could overload the valve actuating mechanism 
resulting in unplanned rapid valve closure which could be disastrous. Fortunately 
this was discovered prior to MPTA hot firing. This event, differing from most others 
cited herein, is an example of subsystem rather than full system testing benefits; 
however, the proper environment must be used to achieve representative data. 
Unfortunately, in many cases, system level testing is the only source of the correct 
environmental conditions and sometimes hardware exclusions restrict such 
environments during system testing — the following issue is an example. 

Facility to ET Orbiter Hydrogen Umbilicals (unworkable, prefliaht) . This is an 
example of hardware exclusions restricting environments for system level testing — 
noted immediately above. Umbilicals were not a part of the orbiter to test site 
interface for MPTA, and a flight configuration ground and airborne disconnect was 
not used for the ET. Extensive difficulties were experienced at the launch site on 
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both of these connections, and yet the actual launch site procedure had been 
performed many times at the test site. 

Firing Termination 

Solid ..Nitrogen Formation in Engine MFV (catastrophic, prefliohtl . Main fuel 
valve leakage after engine cutoff was an infrequent problem. Diffusion of the 
nitrogen engine purge into the fuel system and resultant solidification were 
corrected by engine software modifications permitting the helium fuel system purge 
application once each hour after propellant loading to remove the nitrogen. 

Liquid Qxvoen Low Level Cut Off (ca tastrophic, flight) . Ability to use the 
maximum quantity of onboard oxygen is supportive of maximizing vehicle payload. 
The liquid oxygen low level cutoff system is included to allow maximum usage of 
oxygen and yet prevent engine pump operation with inadequate NPSP, which can 
be destructive/hazardous. Propulsion system test termination by the liquid oxygen 
low level cutoff system was successfully demonstrated for differing test conditions — 
numbers of engines operating, engine thrust level, etc. Optimum time delay— time 
interval between cutoff sensor dry indication and engine shutdown command — was 
determined for various engine combinations. Extensive development activity 
relative to sensor performance, location, etc., was necessary prior to conducting of 
meaningful propulsion system testing. 

Liquid .Hydrogen Low Level Cutoff (work able - mod, expected, flight! . Sensors 
for liquid hydrogen low level cutoff are located within the liquid hydrogen tank near 
the tank bottom. The primary purpose of the liquid hydrogen low level cutoff system 
is prevention of an oxygen rich shutdown and engine operation with inadequate 
NPSP. Hydrogen residuals are small because propellant density is low. The low 
level cutoff system was successfully demonstrated and engine performance was 
shown to be adequate. 

Liquid Hydrogen Dump Sequence (workable - mod, expected, flight) . 
Hydrogen residuals within the propellant delivery system for the orbiter must be 
removed for safing purposes for any normal or aborted mission. RTLS dump 
valves located on the orbiter near the ET/orbiter disconnect can safe the system for 
an aborted mission. For normal missions, hydrogen is dumped overboard through 
the fill-and-drain line. Tests verified proper valve sequencing and line pressurizing 
with helium for inerting for both the RTLS and fill>and-drain valve options. An 
additional venting option was evaluated and determined to be feasible. 

Liouid_Qxvqen Prevalve Closure Demo nstration (unworkable, flight) . The 
liquid oxygen high pressure pump available NPSP for flight was predicted to be 
zero during last engine cutoff. Operation at zero NPSP is hazardous. A procedure 
to prevent zero NPSP operation, to rapidly close the prevalve and pressurize the 
downstream feedline was devised and demonstrated. 
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Miscellaneous 


Nitrogen Purge Termin ation (unworkable, prefiiahtL SSME nitrogen purge 
supply pressure decay time was established to define a sequence at KSC. 

Orbiter/ET Umbilical Ca vity Purge (unworkable, preflightt . The required purge 
flow for the orbiter/ET umbilical varied significantly as a result of varying leakage 
rates; thus the existing "fixed" purge supply approach was inadequate. 
Modifications were necessary. A regulated supply concept was implemented at 
both the test and launch site. 

Liquid Nitrogen Format ion (unworkable, preflioht) . Liquid nitrogen exited the 
intertank drains, and aft fuselage cameras determined the presence and sources 
for liquid nitrogen in the aft fuselage. Improvements primarily to engine insulation 
to prevent local liquid nitrogen generation and modifications to prevent liquid 
nitrogen impacting sensitive hardware were made in the intertank and aft fuselage. 

Freezing Hydraulic Warmant Flow (unworkable. orefliohtL Testing revealed 
that SSME MFV and CCV actuators could not be maintained within required 
temperature limits to prevent freezing with warmant hydraulic flow. Heaters were 
added to the MFV actuators and a warming purge was directed over the CCV 
actuators. A number of special tests of extended time duration were required to 
obtain appropriate data and validate the solution. 

Steer Horn Failure (catastrophic, flight) . A flight configuration engine nozzle 
line containing hydrogen failed at the steer horn — external engine line carrying 
hydrogen to and from nozzle coolant tubes — during hot firing. Extensive hydrogen 
leakage resulted, and burning external to the vehicle occurred. The potential 
cause of line failure was probably interaction between engines firing in a cluster 
configuration. Steer horn redesign was required. 

Liquid Qxvgen Pum p Bearing Spalling (workable • mod, expected, flight). 
Liquid oxygen high pressure pump bearing spalling was a problem during single 
engine development testing. Engine liquid oxygen bleed valve cycling was a 
successful "fix" for the bearing spalling problem. Bleed valve cycling was 
demonstrated during propulsion system testing and incorporated into the launch 
site countdown. 
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MPS HARDWARE PROBLEMS BY TEST 

The preceding section on accomplishments, while including some hardware 
issues, emphasizes system issues. Hardware performance is also a primary 
requirement to be verified. This section provides information on orbiter/ET and 
engine hardware although the two are separated. Presented data on both 
orbiter/ET and engine hardware, as well as the summary, Table 3-3, repeated from 
the main body of the text (Table 13), demonstrates a lack of hardware maturity 
during earlier testing. Without tests to uncover and help resolve the issues early in 
the program, many of these failures/experiences will occur on flight vehicles. 

Qrbiter/ET Hardware Pro blems bv Test 

This section provides a tabulation by test of some of the MPS hardware 
problems experienced during the MPTA program. The tabulation is illustrative and 
is not complete. Repeated problems from test to test are frequently listed only 
once. The following guide will help to interpret the tabulated information. 


Table Interpretation Guide 


• Pre SF-X and SF-X 

• Selected Major Events 

- It Prefiring 

• U Test Events 


• (x) = Firing Duration and y = Date 


* Stage propulsion hardware related - non engine 
- Non-stage propulsion hardware related - engine 


Note: ( 1 ) Most engine GSE items not included 

(2) Repetition between firings omitted in most cases 

(3) SF-X = Static Firing No. X 
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Table 3-3. Hardware Replacement and Repair by Test for MPTA 



Note: Hardware changes made prior to designated test number 


NDH001 
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• Pre SF 1 and SF 1 

• Prevaive closure rate slowed 

• 1 7" O2 disconnect flapper removed 

• Redesigned AFT heat shield for increased loads 


* Engine 2 LH2 prevalve position indicator erroneous 

• LO2 level sensor failed to indicate 

• (1.5 sec) 04/21/78 


• Pre SF 2 and SF 2 

• O2 vent orifice installed. Load under pressure. ET structural problem 

• Many HFA, LFA and acoustic measurement failures 

• LH2 tank diffuser failed 
- MFV 3 leak 

• ET/ORB attach fittings over-torqued 

• (20 sec) 05/18/78 


• Pre SF 3 and SF 3 

• Two auto sequence holds - LH2 recirculation valve failed to close 

• Engine 1 O2 prevalve position switch failed 

• LH2 level sensor failed 

• (42 sec) 06/15/78 


• Pre SF 4 and SF 4 

- ET wall corrosion (under insulation) - discovered post test during 9 months 
down period 
• (104 sec) 07/07/78 

• Pre SF 5A and SF 5A 

• Installed liners in LO2 F&D disconnect 

• Installed new 17" O2 disconnect 

• Installed flight design feedline screens 

• Changed torque on aft ET/orbiter fittings 

• Installed remote mounted engine inlet pressure transducers 

• Installed steel GH2 ET Diffuser 

• O2 tank minimum pressure of 1 .7 PSIG instituted 


- Main fuel valve leak 

• LO2 and LH2 100 percent sensors 3 and 4 failed 

• EIU intermittent problems 

• Recirculation pump electrical and mechanical problems 

• EIU problem. Two changeouts 

• (1.5 sec) 05/04/79 


3-38 



Pre SF 5 and SF 5 


* LO2 ullage pressure offset 2 PSI 

- Full duration test aborted by faulty pump radial accelerometer 

* Numerous EIU problems 

* Various EIU and MDM problems 

• (54 sec) 06/1 2/79 

Note: (1 ) Test 6-01 ; 19 sec of planned duration on 07/02/79 - engine problems 
resulting in major stage repairs 

(2) Test 6-02; 0 sec of planned duration on 10/24/79 - Faulty H2 gas 
controller within aft compartment 

(3) Test 6-03; 10 sec of planned duration on 1 1/04/79 - engine steer horn 
failure 


• Pre SF 6-04 and SF 6-04 

• O2 engine cutoff sensors moved from orbiter to ET 
- Installed He tank vent line venturi 


• Lost several temperature/pressure red line measurements 
- H2 concentration excessive in aft compartment 

• EIU swap for trouble shooting 

• (555 sec) 12/17/79 


• Pre SF 7-02 and SF 7-02 

• Outboard LO2 fill-and-drain valve mechanism failure - changeout 

• One LH2 prevalve changeout 

• Six pressurization orifices enlarged 

• Baffle added to both 100 percent LO2 sensors (liquid level) 

- Two step turbine discharge temperature redline incorporated for start 

- Changed LO2 bleed flow rate/temperature/time required 

• Increased engine stagger time - reduce overpressure 


• Faulty closed indicator on LO2 auxiliary drain valve 

• LO2 ECO sensors responded slowly 

• (555 sec) 02/28/80 


• Pre SF-8 and SF-8 

• All GH2 pressurization orifices enlarged 


• LO2 engine cutoff sensors indicated wet until after cutoff 

* Several orbiter flight transducers failed 

• (541 seconds) 03/20/80 
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• Pre SF 9-02 and SF 9-02 

• Removed baffle from 1 00 percent LO2 sensor 2 

• EIU replaced 

• LH2 flight type ullage transducers installed 


• 1 7" interconnect valve failed to seat 

• (574 sec) 05/30/80 


• Pre SF 10 and SF 10 

• Position indicator switches on 17” disconnect replaced 

• Capacitance probe installed for O2 engine cutoff 

• One EIU replaced 

• Minimum LH2 tank pressure requirement of 3 PSI during replenish 

- Engine fuel preburner burn through aborted test 
• (106 sec) 07/12/80 


• Pre SF 11-02 and SF 11-02 

• New design O2/H2 ullage pressure transducers 

• Maintain 2 PSIG minimum in O2 tank for levels above 20 percent 

• Repaired 17" LH2 disconnect valve 


• LH2 auxiliary drain valve would not close after detanking 
• (588 sec) 1 2/04/80 


• Pre SF 1 2 

• (624 sec) 01/17/81 
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Engine Hardware Problems bv Test 


This section provides a tabulation by test of the engine (component) hardware 
problems experienced during the MPTA program. The following guide will help to 
interpret the tabulated information. 


Table Interpretation Guide 


• Pre SF-X and SF-X 

• Selected Major Events 

• IT Prefiring 

• 11 Test Events 

• (x) = Firing Duration and y = Date 


Note: (1) Most vehicle experiences not included 

(2) GSE experiences not included 

(3) SF-X = Static Firing No. X 


Pre SF-2 and SF-2 

• No gimballing 

♦ Start to 70 percent thrust 


• MFV leak after firing 

* L02 flow meter straighteners cracked 

• (20 sec) 05/18/78 


• Pre SF-3 and SF-3 

• Replaced leaking MFV 

• No gimballing 

• Start to 70 percent thrust. Maximum = 90 percent 

• (104 sec) 07/07/78 
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• Pre SF-4 and SF-4 

• No gimbaling 

• Thrust limited to 90 percent 


• Engine controller channel A electronics failed 

• All 02 flow meters removed post test 

• (104 sec) 07/07/78 


• Pre*SF-5A and SF-5A 

• One engine changeout 

• Several (each) H2 and 02 pump changeout - both high/low pressure 

• Flight nozzles replace stub nozzles 

• MOVs modified to prevent buzz problem 

• No gimballing - LPOP ball strut galling 


• MFV leak - burning vehicle base area 

• Nozzle replaced - bad steer horn weld 

• (1.5 sec) 05/04/79 


• Pre SF*5 and SF-5 

• Changed turbopump feedline bolts 

• Gimballing limited by LPOP strut galling 

• Controller channel B, one engine required post firing replacement 

• Pump accelerometer aborted test . 

• POGO suppressor bubble collapsed 

• (54 sec) 06/1 2/79 


• Pre SF-6-01 and SF-6-01 

• Strain gages added to steer horn 


• Controller failed before firing - test rescheduled 

• MFV cracked - bad damage to vehicle and engine controller 

• POGO accumulator, one engine, failed to charge 

• One engine controller channel A failed 

• Critical flow size (fracture mechanics) became issue 

• High time components became issue 

• (0 sec) 06/39/79, (1 9 sec) 07/02/79 
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• Pre SF-6-03 and SF-6-03 

• Vehicle rebuilt after SF-6-01 problems 

• Same engines as SF-6-01 but approximately 1/2 controllers, pumps, etc., 
exchanged 


• Engine turbine seal failed - test aborted 

• Steer horn ruptured at shutdown 

• (10 sec) 11/04/78 


• Pre SF-6-04 and SF-6-04 

• Replaced one engine 

• Stub nozzles replaced flight nozzles 

• Replaced three turbopumps 

• Seventy percent minimum operating thrust 


• Liftoff seal for H2 pump failed to close 
• (555 sec) 12/17/79 


• Pre SF-7-01 and SF-7-01 


• 02 pump turbine discharge temperature spike - aborted test 

• (5 sec) 02/01/80 


• Pre SF-7-02 and SF-7-02 

• Turbine temperature redline changed - two step during start 

• 02 engine bleed flow rate change 


• H2 pump liftoff seal leaked 

• Engine anomalous start up 

• (555 sec) 02/28/80 


Pre SF-8 and SF-8 

• OPOV reset 

• Seventy percent minimum operating thrust 


• H2 pump seal broken 

• Controller channel B failed 

• (54 sec) 03/20/80 
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• Pre SF-9-01 and SF-9-01 

• H2 pump changeout - one engine 

• Controller changeout - one engine 

• H2 pump manifold collapsed - test aborted 

• 02 pump secondary seal failed 

• (6 sec) 04/18/80 


• Pre SF-9-02 and SF-9-02 

• One fuel pump replaced 

• All high pressure 02 pumps replaced - FMOF capability 

• FASCOS added - one engine 

• POGO accumulator rake removed 

• Bifurcation heat exchanger inspected for faulty material 

• Controller channel B drifted 

• Chamber pressure over-shot during transition to mainstage 

• 02 heat exchanger interface temperature excessive 

• (574 sec) 05/30/80 


• Pre SF-10 and SF-10 

• Stub nozzles replaced with flight nozzle - all engines 

• Fuel preburner burn-through 

• All three engine controllers failed 

• (106 sec) 07/12/80 


• Pre SF-1 1-01 and SF-1 1-01 

• Replace two 02 turbopumps 

• Changed two H2 turbopumps 


* Hole developed in engine nozzle 
• (20 sec) 11/03/80 


• Pre SF-1 1 -02 and SF-1 1 -02 

• Flight nozzles replaced with stub nozzles 


(586 sec) 12/04/80 


• Pre SF-1 2 and SF-1 2 


• (624 sec) 01/17/81 
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APPENDIX 4 


SATURN V S-IC MAIN PROPULSION SYSTEM 


The S-IC stage was the first stage/booster of the Saturn V vehicle (Figure 4-1 ). 
Other stages were S-ll, the second stage discussed in Appendix 5, and S-IVB, the 
third stage discussed in Appendix 6. 

The S-IC stage utilized the propellant combination of RP-1 fuel and liquid 
oxygen in its five F-1 engines. The engines were arranged in a cluster with one 
engine mounted in the center and the other four mounted outboard around the 
center engine. Thrust vector control was accomplished by gimballing the four 
outboard engines. Figures 4-2 through 4-6 support the stage and systems 
description which follows. 

Major components of the S-IC included the thrust structure, fuel tank, intertank, 
liquid oxygen tank, and forward skirt. The thrust structure absorbed the punishment 
of the five engines and redistributed the forces into uniform loading around the 
base of the rocket. The thrust structure also provided support for the engines and 
engine accessories and miscellaneous equipment. There were four holddown 
posts to hold the vehicle in place prior to liftoff. Four fins mounted at the base of S- 
IC provided necessary stability margins for the total Saturn V vehicle. 

The propellant tanks included special fill-and-drain hardware to fill the tanks at 
high flow rates (2000 GPM for RP-1 fuel and 10,000 GPM for liquid oxygen). The 
original design of the propellant system included a fuel bubbling system using 
nitrogen to prevent temperature stratification of the fuel. During propulsion system 
testing, this was determined to be unnecessary and was eliminated. Liquid oxygen 
bubbling with helium to prevent geysering and stratification was continued 
throughout the program. 

Pressurization of the RP-1 fuel tank in flight was accomplished with helium 
drawn from four elongated aluminum bottles mounted in the liquid oxygen tank. 
The cold helium was heated by ducting it through heat exchangers on the F-1 
engines. The liquid oxygen tank was pressurized with oxygen obtained by tapping 
off liquid oxygen from the engine liquid oxygen domes and ducting it through heat 
exchangers on the engines. 

The hydraulic system used to gimbal the four outboard engines featured a 
somewhat unconventional approach in that it used RP-1 fuel as the actuating fluid. 
The RP-1 fuel was taken directly from the high-pressure fuel duct, routed to the 
gimbal system, then returned to the engine fuel system. To compensate for the 
shortcomings of RP-1 fuel as the fluid, special care was taken in the design of 
valves. 

Brief descriptions of some of the major subsystems of the S-IC stage are 
contained in the following paragraphs: 
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LAUNCH ESCAPE SYSTEM 


COMMAND MODULE 
SERVICE MODULE 


LUNAR MODULE 
INSTRUMENT UNIT (IU) 

6.6 MITERS 121.7 FEET) 

09METCRS (3 FEET) 

2.040 KILOGRAMS U.500 POUNDS! 


DIAMETER: 

HEIGHT 
WEIGHT 

CONTRACTOR IBM CORPORATION 


THIRD STAGE (5-IVB) 


DIAMETER 9.6 METERS (2V 7 FEET) 

HEIGHT It 1 METERS IM 3 FEET1 

WEIGHT 121.000 M. FUELED (266 000 LBS.) 

11.300 fc«. ORV 124.900 LBS. I 
ENGINE ONE J-2 

PROPELLANTS LIQUID OXYGEN 09 000 k% (196.000 LBS.) 

LIQUID HYDROGEN IfWOkf 1*3.750 LBS.) 
THRUST 929.367 NEWTONS (201.2*2 LBS.) 

CONTRACTOR McOONNfLL DOUGLAS ASTRONAUTICS CO 


SECOND STAGE (S-ll) 

DIAMETER: 10 1 METERS 113 PICT) 

HEIGHT: 2* • METERS Itl. S PC ET1 

WEIGHT: 49T316 kf. FUELED M OST. 5*0 LBS.) 

56*76 k% DRY (60.420 LBS.) 

ENGINES: FIVE ±2 

PROPELLANTS: LIQUID OXYGEN 314 000 1145.713 LBS ) 

LIQUID HYOROGEN 73 000 k% (IU.4M LBS.) 
THRUST 5.131 MB NEWTONS M. 153.712 LBS.) 

CONTRACTOR ROCKWELL INTERNATIONAL 


FIRST STAGE (S-IC) 


DIAMETER: 10.1 METERS (33 PCET1 

HEIGHT: 42.1 METERS (131 PIET1 

WEIGHT: 2-246.540 fcf, FUELED (4.ISZ.77S LBS.) 

130.441 H ORV 12*7.574 LBS.) 
ENGINES: FIVE F I 

PROPELLANTS: LIOUID OXYGEN 1.471.427 k* 

0.2*3 9*2 LBS.) RP1 KEROSENE 
642.177 k* 0,415.257 LBS.) 

THRUST: 34. OM 1 10 NEWTONS 17.66*. Ill LBS.) 

at urr OFF. 

CONTRACTOR: THE BOEING COMPANY 


FIGURE 4-1. SATURN V LAUNCH VEHICLE 
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Liquid Oxvaen System (Figure 4-Pi 


• One tank - forward position. 

• Five suction lines (one per engine) routed through fuel tank tunnels. 

Liquid Oxygen FILL 

• Prevalves, vent valves and inter-connect valves 1, 3, and 4 in open 
position. 

• Open liquid oxygen fill-and-drain valves 1 and 2. 

• Fill rate: -10, 000 gpm (~5,000 gpm per valve). 

• Mass loaded controlled by liquid oxygen loading level sensor. 

• Fill and drain valve 3 available for use, if required. 

Liquid Oxvaen Replenish 

• Required continuously until start of prepressurization. 

• Replenishing controlled by liquid oxygen loading level sensor. 

Normal Liquid Oxvoen Drain 

• Vent helium bottles and close vent valves. 

• Pre-valves and interconnect valves 1 , 3, and 4 in open position. 

• Pressurize liquid oxygen tank (from ground) 

• Open fill-and-drain valves 1 and 2, which allowed drainage of cylindrical 
portion of tank. 

• To drain lower bulkhead and partially drain suction lines, opened liquid 
oxygen interconnect valve 2 and liquid oxygen fill-and-drain valve 3. 

Emergency Liquid Oxvaen Drain 

• S-IC had double-piston, pneumatically-actuated 17-inch emergency drain 
valve installed for static-removed after static. 

Prevalves 

• S-IC used normally-open, pneumatically-closed, 17-inch valves, with 
redundant closing provisions using ground supplied nitrogen for static test 
and/or on-pad abort. 

Liquid Oxvoen Conditioning 

• Geysering suppression by thermal pumping. 

- Suction lines interconnected to establish flow path. 

- Two separate thermal pumping systems isolated by interconnect valve 
2 . 

- Thermal pumping initiated during initial filling by injecting helium into 
suction lines 1 and 3. 
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- When any prevalve or interconnect valve (other than 3) was closed, 
helium bubbling was required in all suction lines. 

- Prevalves relieved at ~50 psig. 

• Pump inlet temperature controlled by thermal pumping. Initiated helium 
bubbling in lines 1 and 3 at T-10 minutes and continued until start of liquid 
oxygen pressurization. Interconnect valves closed immediately prior to 
ignition. 

Engine Cutoff Sensor 

• Inboard: liquid level sensor 

- Signal from sensor initiated time, expiration of which signaled IECO. 

• Outboard: Four liquid level sensors - signals required from two of four to 
initiate timer, expiration of which signaled OECO. 

P-U Slosh Measuring 

• Five continuous capacitance probes provided data for continuous profile 
for determination of sloshing and consumption as function of flight time. 

• No active P-U system in flight: "tailored tanking" used to insure 

simultaneous depletion of propellants. 

Liquid Oxvaen Pressurization System (Figure 4-3) 

Pre-Ignition: Ground Supplied Helium 

• Closed vent and relief valves. 

• Helium admitted through coupling and check valve to tank. 

• Liquid oxygen prepressurization switch (actuated 26.0 psia, deactuated 
24.2 psia, 501 and 502; 503 and subs actuated 26.5 psia, deactuated 24.2 
psia) signaled ground valve to close. 

• Liquid oxygen relief switch (actuated 29.0 psia, deactuated 27.5 psia, 501 
and 502; 503 and dubs actuated 30.0 psia, deactuated 28.0 psia) signaled 
liquid oxygen vent and relief valve to open. 

• Helium supply remained connected until liftoff. 

Flight 

• Liquid oxygen tapped off liquid oxygen dome to engine heat exchanger. 
Liquid oxygen transformed to gaseous oxygen and routed to common 
manifold through gaseous oxygen flow control valve to tank. 

• Gaseous oxygen flow control valve: Designed to maintain liquid oxygen 
tank ullage pressure at 20.5 +/- 2.5 psia. Used liquid oxygen tank pressure 
as reference. 

• Modulated flow to tank between an optimized 30 - 50 #/sec, with maximum 
flow capacity of 70 #/ sec. 

• Minimum flow through heat exchanger ensured by using mechanical stop 
(adjustable) in gaseous oxygen flow control valve. 
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• Liquid oxygen vent and relief valve controlled by either the liquid oxygen 
relief switch or the liquid oxygen vent and relief switch (actuated 25.5 psig, 
deactuated 23.7 psig, 501 and 502; 503 and subs actuated 25.0 psig, 
deactuated 22.0 psig) between -T+65 sec and ~T+75 sec. After ~T+75 
sec, the vent and relief switch assumed primary control of the valve. 

• Vent and relief valve mechanically relieved at 24.0 - 25.5 psig. 

Fuel System (Figure 4-41 

• One tank (aft position) RP-1 fuel 

• Ten suction lines (two per engine) 

Fuel Fill 

• Prevalves and vent and relief valve(s) in open position 

• Opened N.C fill-and-drain valve (6" diameter) 

• Fill rate: -2000 gpm 

• Mass loaded controlled by liquid oxygen loading level sensor 

• Temperature sensors (total of nine, three sets of three) in tank for density 
determination 

Normal Fuel Drain 

• Opened venK.nd-relief valve 

• Opened fill-and-drain valve 

• Drained by gravity or closed vent-and-relief valve(s) 

• Pressurized tank 

• Opened fill-and-drain valve 

Emergency Fuel Drain 

• S-IC had double-piston, pneumatically-actuated 12-inch diameter 
emergency drain valve installed for static test — removed after static test. 

Prevalves 

• S-IC used normally-open, pneumatically-closed 12-inch valves, with 
redundant closing provisions using ground supplied nitrogen for static 
tests and/or on-pad abort. 

Engine Cutoff Sensors 

• Engine cutoff normally initiated by liquid oxygen-orientated system. 

• Fuel-oriented back-up cutoff system provided (to guarantee fuel-rich 
cutoff). 

- Fuel bi-level sensor with redundant sensing elements at both levels — 
fuel passed upper level, inboard engine cutoff (IECO) initiated; fuel 
passed lower level, timer initiated, expiration of which signaled 
outboard engine cutoff (OECO). 
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- Cutoff circuitry for outboard and inboard completely separate. Each 
system armed ~5 seconds prior to predicted IECO and OECO, 
respectively. 

Propellant Utilization (P -U) and Slosh Measuring 

• Five continuous capacitance probes provided data for continuous profile 
for determination of sloshing and consumption as function of flight time. 

• No active P-U system n flight; "tailored tanking" used to ensure 
simultaneous depletion of propellants. 

Thrust Chamber Fuel Jacket Prefill 

• Thrust chamber jacket tubes and fuel manifold were filled with sodium 
nitrate solution prior to engine start to aid in the prevention of rough 
combustion. 

• Solution supplied to vehicle manifold and routed to each engine fuel 
manifold. 

Fuel Pressu rization System (Figure 4-5) 

Pre-lanition; Ground Supplied Helium 

• Closed vent and relief valve(s). 

• Helium admitted through coupling and heat exchangers to common 
manifold to tank. 

• Fuel prepressurization switch (actuated 29.0 psia, deactuated 27.5 psia) 
signaled ground valve to close. 

• Helium supply connected until liftoff. 

• All five pressurization valves remained closed until liftoff. 

Flight: Chilled Helium— Heat Exchanger 

• Four helium storage bottles in liquid oxygen tank. 

- Pressurized to 1500 psig prior to liquid oxygen loading. 

- Pressurized to ~3150 psig after liquid oxygen loading; hi pressure OK 
pressure switch (actuated 3150 psia +/- 40 psia, deactuated 3010 psia 
minimum) interlocked in firing command circuitry. Helium temperature - 
283*F maximum. 

- N.C. emergency dump valve provided for rapid evacuation of bottles, if 
required. 

• Five pressurization valves; one N. O. and four N.C. 

- Four programmed 

- One operated off pressurization switch (actuated 26.0 psia, deactuated 
24.2). 

• One N.C vent-and-relief valve operated off vent switch (actuated 31 .5 psia, 
deactuated 29.7 psia). Valve mechanically relieved at 30.5 - 35.0 psia. 
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FIGURE 4-5. S-IC FUEL PRESSURIZATION SYSTEM 
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F-1 Engine (Figure 4-6) . The general features of the F-1 engine were: 


• Single start 

• Fixed thrust: 1 ,500,000 pounds at sea level 

• Propellants: liquid oxygen and RP-1 fuel 

• Engine mixture ratio: 2.2:1 

• Lubricant: RP-1 fuel 

• Control fluid: RJ-1 for standby and start, RP-1 fuel for operation 
Engine Start Sequence 

• The ignition sequencer controlled start of all five engines. 

• Checkout valve moved to engine return position 

• Electrical signal fired igniters (four each engine) 

- Gas generator combustor and turbine exhaust igniters burned igniter 
links to trigger electrical signal to start solenoid of four-way control 
valve. 

- Igniters burned approximately six seconds. 

• Start solenoid of four-way control valve directed GSE hydraulic pressure to 
main oxidizer valves 

• Main oxidizer valves allowed liquid oxygen to flow to thrust chamber and 
GSE hydraulic pressure to flow through sequencer valve to open gas 
generator ball valve. 

• Propellants, under tank pressure, flowed into gas generator combustor. 

• Propellants were ignited by flame of igniters. 

• Combustion gas passed through turbopump, heat exchanger, exhaust 
manifold and nozzle extension. 

• Fuel rich turbine combustion gas was ignited by flame from igniters. 

- Ignition of this gas prevented backfiring and burping. 

- This relatively cool gas (approximately 550’ C) was the coolant for the 
nozzle extension. 

• Combustion gas accelerated the turbopump, causing the pump discharge 
pressure to increase. 

• As fuel pressure increased to approximately 26,400 grams per square 
centimeter (375 psig), it ruptured the hypergol cartridge. 

• The hypergolic fluid and fuel were forced into the thrust chamber where 
they mixed with the liquid oxygen to cause ignition. 

Transition to Mainstaoe 

• Ignition caused the combustion zone pressure to increase. 

• As pressure reached 1,400 grams per square centimeter (20 psig), the 
ignition monitor valve directed fluid pressure to the main fuel valves. 

• Fluid pressure opened main fuel valve. 

• Fuel entered thrust chamber. As pressure increased, the transition to 
mainstage was accomplished. 

• The thrust OK pressure switch (which sensed fuel injection pressure) 
picked up at approximately 74,500 grams per square centimeter (1060 psi) 
and provided a THRUST OK signal to the IU. 
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FIGURE ^1-6. F-l ENGINE SCHEMATIC 




Engine Cutoff Sequence 


• Cutoff initiated by electrical signal which energized the Stop Solenoid (part 
of the four-way solenoid valve). 

• Actuation of Stop Solenoid closed the pressurization port, venting 
entrapped fluid and directing closing pressure to the GG valves, MOVs and 
MFVs. 

• MOVs closed before MFVs to provide fuel-rich cutoff. 

Engine Gimbal System 

• Incorporated on outboard engines. 

• The gimbal system positioned the outboard engines by gimballing the 
entire engine with two servo valve and actuator assemblies, which used 
high pressure fluid (RJ-1 from GSE during standby and start, RP-1 fuel 
from fuel pump outlet during engine operation) as the actuating medium. 

• First gimbal system to use engine fluid at engine turbopump pressure to 
gimbal engine for stage thrust vector control. 

• Operational pressure: 1800- 2200 psi 

• Rated flow at rated load: 120 gpm 

• Rated load: 72,000 pounds 

• Rated velocity: 5 deg/sec minimum 

• Engine gimbal angle: +/- 5 deg 

S-IC PROPULSION SYSTEM TEST OBJECTIVES 

The major objective of the S-IC propulsion system test program was the 
establishment of the feasibility of making a major step upward in thrust from 1.5 
million pounds for S-IB to 7.5 million pounds thrust for S-IC. 

Additional objectives were: 

• Establish functional compatibility between the ground support equipment and 
the stage systems 

• Establish adequacy of operating procedures 

• Evaluate performance of the thrust vector control system 

• Evaluate fuel and oxidizer feed systems performance 

• Evaluate fuel and oxidizer onboard pressurization systems 

• Evaluate propellant loading systems and procedures 

• Evaluate liquid oxygen geyser prevention system and procedures 

• Evaluate performance of flight instrumentation and telemetry system 
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• Evaluate structural capability of the stage 

• Evaluate optimum engine start-up sequence 

• Verify F-1 engine performance in a clustered configuration 

A total of 15 development static firings were required to satisfy these 
objectives of which three were full duration. 

S-IC TEST ACCOMPLISHMENTS 

Following is a listing of accomplishments achieved by the S-IC propulsion 
system test program. Each issue has been classified as to consequence and time 
phasing for which the issue may apply as was done in Appendix 3 for Space 

Q hi ittl a ’ 


Hydraulic Supply Line Failure (catastrophic, flinhti The S-IC stage was the 
first to use RP-1 fuel as the hydraulic fluid in the stage hydraulic system. During 
static test S-IC-13 on the all systems test stage, the flight supply line from the fuel 
high pressure duct to the gimbal filter manifold on engine position 2 failed 
structurally and leaked. This presented a fire hazard, as well as the possibility of 
impairing the performance of the stage TVC system. A redesign of the supply line 
was made to prevent a recurrence of this problem. 

Inadequate Li quid Oxygen Puma Seal Purge Suddiv toitastmnhir fiinhn 
The F-1 engine liquid oxygen pump seal formed a barrier which prevented liquid 
oxygen from the liquid oxygen pump and the RP-1 from the fuel pump from coming 
in contact with each other. The cavity in which the seal was located was purged 
with nitrogen during operation to carry any seal leakage overboard. Mixing of the 
liquid oxygen and RP-1 would create a hazardous situation. The original S-IC 
design incoiporated only one 1 .27 cubic foot storage sphere of nitrogen. During 
the propulsion system test program, it was determined that this volume was 
inadequate for the planned S-IC flight duration. A redesign added two additional 
storage spheres for nitrogen. 

L oose Hel i um Bottle Retainer Nuts in Liquid Oxvoen Tank /catastrnnhip 
want)- The S-IC stage used helium to pressurize the liquid oxygen tank during 
flight. As a weight saving measure, the helium storage bottles were located inside 
the liquid oxygen tank. Results from the propulsion system test program revealed 
that the retainer nuts holding the storage bottles in place were becoming loosened 
during propulsion system operation. A redesign was made to fasten the nuts more 
securely. 

Failure Qf Engine Mount Bolts (catastrop h ic, flight) . During a post-test 
inspection following a propulsion system static firing, it was determined that three 1 
3/8 inch bolts which attached the center engine to the stage thrust structure had 
failed. Investigation found that the bolt material was not suitable for use in these 
mount bolts. A redesign changing material for the bolts was made. 
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Terminal Countdown Sequencer D eficiency (unworkable, preflioht). The 
terminal countdown sequencer (TCDS) was discovered to have a design 
deficiency which caused it to output all its commands at one time should a 
malfunction or loss of power supply occur. Since this occurrence might cause a 
catastrophic failure, the TCDS was modified for future use. 

Deletion of Fuel Bubblin g System (improvement, prefliaht). The original 
design of the S-IC stage incorporated a fuel bubbling system to prevent 
temperature stratification in the fuel tank. Data obtained during the propulsion 
system test program proved that temperature stratification in the fuel tank was not a 
problem and that fuel bubbling was not necessary. Fuel bubbling was deleted from 
the flight stages resulting in simplification of procedures and hardware and weight 
reduction. 

Liquid Oxygen Pump Seal Purge Orifice Remov al (improvement, flight). The 
initial S*IC design incorporated stage mounted orifices in the liquid oxygen pump 
seal purge supply lines. Data from the propulsion system tests showed that the 
orifices were unnecessarily restricting the purge flow rate below the specification 
requirement. Removing the orifices resulted in the required flow rate being 
obtained and simplified the stage design. 

Liquid Oxygen Low Level Cutoff System Calibrati on (workable, flight). For 
flight stages which use liquid oxygen for an oxidizer, a low level liquid oxygen 
cutoff system is necessary to obviate the possibility of a liquid oxygen rich cutoff 
occurring with possible catastrophic results. During the S-IC propulsion system 
test program, liquid oxygen low level cutoff sensors were installed. These sensors 
were monitored during tests in order to gather data on their operation for the 
purpose of properly calibrating them for flight stage use. 

Erroneous "Drv" Signals F rom Liquid Qxvoen Depletion Sensors 
ninworkahle. flight! . During the S-IC propulsion system test program, it was found 
that bubbles in the liquid oxygen engine feedlines could rise past the liquid oxygen 
low level cutoff sensors giving an erroneous "dry" signal which could trigger engine 
cutoff. This required that provisions be made for a propellant system reset 
command to be initiated from the stage switch selector. This was necessary to 
prevent launch delays because of erroneous cutoffs during launch countdown. 

Ice and Frost Formation on Engine Inje ctor Faces (unworkable, prefliaht). 
Pretest checkout for tests in the S-IC propulsion system test program revealed that 
ice and frost were being formed on the injector face of the F-1 engines. Ice and 
frost on the injectors could be deleterious by plugging holes in the injector and 
affecting the engine mixture ratio. Investigation revealed that the following three 
conditions were required for injector frosting to occur: 

• Liquid oxygen admitted to the engine for sufficient time to "cold soak" the liquid 
oxygen dome and injector 

• Thrust chamber prefilled 
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• Liquid oxygen dome service purge in use 

Based on these findings, two procedure adjustments were made: 

• The thrust chamber prefill operation was accomplished prior to liquid oxvaen 

tanking. 73 


Use of the liquid oxygen dome service purge was minimized when liquid 
oxygen was on board. 

Iii rust Chamber Inert Pre-Fill GSE Malfunction (unworkable aiallifliUl Asa 
means to reduce the likelihood of rough combustion in the F-1 engine, the thrust 
chamber tubes were pre-filled with an inert liquid which acted as a fuel lead in the 
combustion chamber and cushioned the engine against a hard start. The original 
design of the GSE which was to be used for the pre-filling operation incorporated 
full sensors which were to terminate the filling operation automatically when the 
proper level was reached. Experience with the equipment during the test program 
showed that the automatic fill feature did not function properly because solution 
sloshing during flow activated the full sensors prematurely. Based on this 
experience, the automatic filling control circuits were deleted. 

Erroneous Igniter Failure Cutoffs (unwo rkable, flighty The F-1 engine used 
igniters in the ignition sequence to initiate combustion in the gas generator and the 
turbine exhaust gas. Burning of the igniters was monitored by electrically recording 
when a link broke during the burning phase of the igniters. Originally, the igniter 
link break was incorporated in the engine start sequence and automatic cutoff was 
received if the links did not break in a timely manner. Test experience showed that 
the igniter lips did not always exhibit a clean break when burned and could cause 
an erroneous igniter failure cutoff. Circuit changes were made to remove igniter 
link break from the automatic cutoff circuit to prevent erroneous cutoffs. 

Distorted Gimballino Drive Signals funworkable. flighty Data obtained during 
the S-IC TVC system gimballing tests showed that the TVC servo amplifiers 
provided noisy, distorted drive signals, causing erratic positioning of the engines. 
A new gimbal actuator signal amplifier circuit was incorporated in the operational 
amplifier. 
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APPENDIX 5 


SATURN V S-ll MAIN PROPULSION SYSTEM 


The S-ll stage, the second stage of the Saturn V launch vehicle, was a 
cylindrical booster 81 .5 feet tall and 33 feet in diameter. It was powered by five 
liquid propellant J-2 rocket engines which developed a nominal vacuum thrust of 
200,000 pounds each and were ignited at altitude approximately 2 1/2 minutes 
after liftoff. Four J-2 engines were equally spaced on a 17.5 foot diameter circle 
and were mounted on gimbal bearings to provide thrust vector control while the fifth 
engine was mounted on the stage centerline and was fixed. A cut away drawing is 
shown in Figure 5-1 . 

The S-ll stage propulsion system consisted of the propellant tanks, (included 
in the airframe structure), propellant systems, pressurization systems, and J-2 
engines. 

The propellant tanks included the liquid hydrogen tank and the liquid oxygen 
tank. The tanks provided structural support between the forward and aft skirts. 

The liquid oxygen tank (Figure 5-2) consisted of ellipsoidal fore and aft 
bulkheads with waffle-stiffened gore segments. The tank was fitted with three ring- 
type slosh baffles to control propellant sloshing and minimize surface disturbances, 
and cruciform baffles to prevent the generation of vortices at the tank outlet ducts. 
A six port sump assembly located at the lowest point of the tank provided a fill-and- 
drain opening and openings for the five engine feedlines. 

The liquid hydrogen tank (Figure 5-3) consisted of a long cylinder with a 
concave modified ellipsoidal bulkhead forward and a convex modified ellipsoidal 
bulkhead aft. The aft bulkhead was common to the liquid oxygen tank. 

All exposed surfaces of the liquid hydrogen tank were covered with foam 
insulation to prevent air liquification and reduce temperature rise during cryogenic 
operation. 

Prnpflllant Systems 

The propellant systems consisted of the fill, feed, recirculation, and propellant 
management systems. 

The liquid hydrogen fill-and-drain system consisted of the fill valve and the 
airborne part of the fill disconnect coupling, while the liquid oxygen fill-and-drain 
system included the fill valve mounted to the liquid oxygen pump interface, 16 feet 
of 8-inch line with a pressure-compensating bellows, one free bellows and two 
universal bellows ball-joints to provide movement, and the airborne part of the fill 
disconnect coupling. 
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Propellant conditioning was required to cool the vehicle feedlines and the 
engines and ensure required propellant temperatures were available to the 
engines prior to and at ignition. This was necessary to ensure acceptable engine 
start. 


Liquid oxygen conditioning was accomplished by recirculating liquid oxygen 
from the tank through feed ducts and the prevalves to the engine turbopump, into 
the return lines and back into the liquid oxygen tank. Liquid oxygen flow was 
initiated after start of liquid oxygen fill and continued until T-30 minutes. Pumps 
were not used to recirculate flow as is often the case— flow was dependent on 
thermally-inducted flow. At that time, helium was injected into the liquid oxygen 
recirculation return line to boost recirculation and was continued until just before S- 
II ignition. 

Liquid hydrogen recirculation was initiated at T-30 minutes and was 
terminated immediately prior to S-ll ignition. Forced recirculation during launch 
consisted of closing the liquid hydrogen prevalves and operating the liquid 
hydrogen recirculation pumps. 

The liquid oxygen feed system (Figure 5-2) supplied liquid oxygen to the five 
engines. The system included four 8-inch vacuum jacketed feed ducts, one 8-inch 
uninsulated feed duct, and five normally open prevalves. At approximately 300 
milliseconds after the main valves closed, the liquid oxygen prevalves were closed. 
This provided a redundant shutoff for the liquid oxygen feed system. 

The liquid hydrogen feed system (Figure 5-3) supplied liquid hydrogen to the 
five engines. The system included five 8-inch vacuum jacketed feed ducts and five 
normally open prevalves. The prevalves were closed following tank loading, 
recirculation system operation was initiated and continued until 2.2 seconds before 
S-ll engine start at which time prevalves were opened and engines started. 
Approximately 425 milliseconds after the engine main valves closed, the liquid 
hydrogen prevalves were closed. This provided a redundant shutoff for the liquid 
hydrogen feed system. 

Tank Press urization 

After completion of propellant loading and shortly before launch, the oxygen 
propellant tank was pressurized to the required level by helium from separate 
ground supplies. Liquid oxygen tank pressurization (Figure 5-4) from vehicle 
sources was initiated at S-ll ignition and continued until engine cutoff. 
Pressurization was accomplished by using gaseous oxygen obtained by diverting 
a portion of the liquid oxygen supplied to the engine into the heat exchanger. The 
exiting gaseous oxygen flowed into a common pressurization duct through the tank 
pressurization regulator, and into the tank through the gas distributor. The 
pressurant flow rate was varied according to tank ullage pressure which was 
sensed by the reference pressure line from the tank. 

The liquid hydrogen tank was initially pressurized with ground-supplied 
helium immediately prior to liftoff, as was done for oxygen. Liquid hydrogen tank 
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pressurization (Figure 5-5) from vehicle sources was initiated after engine ignition. 
Hydrogen was bled from the thrust chamber hydrogen injector manifold of each of 
the four outboard engines. The hydrogen from each injector manifold flowed into a 
stage manifold, through the pressurization line and tank pressurization regulator 
(orifice for later vehicles), and into the liquid hydrogen tank ullage space via the 
gas distributor. The flow rate was varied according to the liquid hydrogen tank 
ullage pressure which was sensed by the reference pressure line from the tank. 

J -2 E n g ine 

The J-2 rocket engine (Figure 5-6) utilized the propellant combination of liquid 
oxygen and liquid hydrogen propellants and provided a nominal thrust of 200,000 
pounds. The basic engine envelope was 116 inches long with a diameter of 80 
inches. Dry weight was 3,500 pounds. Each engine incorporated self contained 
provisions for propulsion, control, and initial starting energy. 

Primary engine propulsion components consisted of an axial flow liquid 
hydrogen pump, a centrifugal liquid oxygen pump, a single gas generator 
combustor, a tubular wall hydrogen cooled thrust chamber, a concentric orifice 
sweat-cooled injection plate, and a tubular wall hydrogen-cooled nozzle.. 

The two independently operated turbopumps were driven in series by the 
exhaust of the gas generator combustor and provided high pressure propellants to 
the thrust chamber/injector assembly. The gas generator was powered by 
propellants tapped off downstream of the turbopumps. 

Each engine provided gas for pressurization of the stage propellant tanks. 
Hydrogen was tapped off downstream of the thrust chamber cooling jacket, liquid 
oxygen was provided by a heat exchanger mounted in the gas generator exhaust. 

The S-ll engine start sequence was as follows: 

• Start command (occurred at T3 +1.4) engine ready. 

• Augmented spark igniter (ASI) spark plugs and gas generator (GG) spark plugs 
fired. 

• Bleed valves stopped return flow to propellant tanks. 

• Oxidizer dome and gas generator oxidizer injector were purged. 

• Main fuel valve allowed liquid hydrogen to flow into engine thrust chamber and 
into ASI. 

• ASI oxidizer valve allowed liquid oxygen to flow to ASI. 

• Sparks ignited the propellants in the ASI. 

• Stage supplied mainstage enable signal. 
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FIGURE 5-5. S-II STAGE FUEL PRESSURIZATION SYSTEM 
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• Start tank discharged hydrogen causing the liquid hydrogen and liquid oxygen 
turbopumps turbines to buildup propellant pressure. 

• Liquid oxygen turbopump bypass valve opened to control liquid oxygen pump 
speed. 

• Main oxidizer valve opened allowing liquid oxygen to be injected into thrust 
chamber 

• GG valves admitted propellants. (Spark ignited propellants causing pressure 
buildup.) 

MAINSTAGE 

• OK pressure switches sent mainstage OK signal to CM. 

• Engine out lights went out. 

• Engine reached and maintained 90 percent thrust or more. 

• PU valve controlled mass ratio by returning liquid oxygen from pump discharge 
to pump inlet. 

Propellant combustion was initiated within a cavity called the augmented 
spark igniter (ASI) which was located in the body of the main injector plate. Ignition 
was provided by spark plugs. Tank head provided propellant supply pressure. An 
engine mounted start tank precharged with hydrogen gas provided starting power 
for the turbopumps. 

A self contained pneumatic system was used to actuate all engine valves. 
The system was comprised of a 1000 cubic inch storage bottle, regulator package, 
and low pressure accumulator. An electrical control assembly provided control of 
valve seauencing during start/cutoff, spark plug excitation and Internal emergency 
detection. The mixture ratio control valve provided control of combustion mixture 
ratio as well as thrust control. The valve was mounted on the liquid oxygen pump 
and was pneumatically actuated by an engine mounted stage controlled solenoid. 
The valve recirculated liquid oxygen from the pump outlet manifold back through 
the inlet. 

The four outboard engines were gimbai mounted to allow thrust vector control. 
A hydraulic pump mounted in the liquid oxygen turbopumps shafts provided 
hydraulic power for the stage engine actuation system. 

S-ll PROPULSION SYSTEM TEST OBJECTIVES 

Verification of the S-ll configuration required extensive testing that included 
separate system and component tests. The assemblies for propulsion system 
testing included the Battleship stage at the Santa Susana Field Laboratories and 
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the All Systems Test Stage (S-il-T) at the Mississippi Test Facility. Additional test 
articles used in the S-ll program are listed below. 

The 3-ll-S configuration was a structurally complete stage used to certify the 
integrity of the entire airframe under simulated critical loads and pressure 
differentials. 

The S-ll-F/D configuration was used at KSC to verify its compatibility with 
other launcn vehicle stages, ground support equipment, the launch pad, and other 
supporting facilities of launch complex 39. At MSFC the vehicle was used in the 
Saturn V dynamic testing to determine the dynamic characteristics of the launch 
vehicle. 


A listing of Battleship and S-ll-T test objectives follows. Fifteen Battleship and 
seven S-ll-T firings before the first flight were required to satisfy these objectives, 
although total firing attempts for the total program were sixty-three with twenty-eight 
successful completions. 

• Verify the capability of the stage to accept and deliver cryogenic propellants 

• Evaluate performance of the integrated GSE and stage systems 

• Verify thermal and structural adequacy of the stage insulation 

• Verify acceptable operation of the liquid oxygen anti-geyser system 

• Verify operation of the liquid hydrogen and oxygen recirculation systems 

• Verify operation of the propellant utilization system for automatic replenishing 
and control of the engine mixture ratio 

• Evaluate performance of the thrust vector control system 

• Evaluate flight instrumentation and telemetry system 

• Evaluate and calibrate the liquid oxygen depletion cutoff system 

• Evaluate the performance of J-2 engines in the clustered configuration 

• Determine structural capability of stage systems 

• Evaluate the performance of the stage flight propellant pressurization systems 
S-ll TEST ACCOMPLISHMENTS 

A summary of significant accomplishments experienced during S-ll stage 
propulsion system testing is presented in the following paragraphs. Again each 
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issue has been classified as to consequence and time phasing for which the issue 
may apply as was done previously in Appendix 3 for Space Shuttle. 

Actuator Abnormal Motion (unwo rkable, orefliaht/fliahtL For four to five 
seconds after "slam" release during S-ll-3 static firing, the Engine 3 yaw actuator 
exhibited abnormal piston position output. The cause was attributed to noise 
induced on the actuator command by an improper instrumentation circuit. The 
command current measuring resistor was incorrectly installed. The resistor was 
relocated and the problem did not recur. 


Faulty Solder Joint/Seals (unworkable, orefliaht/fliohtL Numerous pressure 
switch failures were attributed to defective (porous) solder seals. Although a 
number of corrective actions were taken to eliminate the problem, it was concluded 
that the solder joint seal was not acceptable for sealing vacuum cavities. Welded 
cavity seals were implemented and acceptability confirmed in propulsion system 
testing. 


Fill-and-Drain Valve and Recirculation Valve Position Indicator Anomalies 
^unworkable, prefliqhtl . During checkout of the liquid oxygen fill-and-drain valve on 
S-ll-6 at MTF, the "OPEN” indication was not received and could not be corrected 
by subsequent trouble-shooting adjustment. The same type of problem had been 
experienced on the recirculation valves and early prevalves which incorporated a 
similar magnetically actuated position indication device. The failure of the closed 
or open indication to pick up when the valve was actuated was attributed to an 
apparent shift in the indicator dead band between ambient calibration and usage at 
cryogenic testing, and by tolerance on the initial switch setting. The primary 
concern was that malfunctions of the position indicators on the fill valves would 
cause propellant loading reverts, holds, and/or scrubs during static firing or launch 
countdowns due to interlocks. SCO's were revised, quality control procedures 
were improved, and electrical interlock requirements were deieted/revised. These 
actions were proper and adequate, although not necessarily comprehensive in that 
an effective complete redesign was not feasible and probably not possible 
because of the time required for an effective solution to the problem. 


Vent Valve P osition Indicator Anomalies (unworkable, prefliahtl. Numerous 
vent valve position irritation anomalies occurred throughout the S-ll program on 
flight stages, test stages, qualification testing, and acceptance testing. The 
anomalous conditions consisted of dual indications ("open" and "closed" 
indications both received), erratic indicators, slow or no response, and chatter. The 
problem was attributed to freezing of air or nitrogen within the switch causing 
binding of the actuation mechanism. Fixes were made; however, anomalies 
continued to occur. 


Liquid Qxvaen Vent Valve Low Res eat (unworkable, orefliohtL During 
prestatic firing tests on the S-ll-1 stage, a liquid oxygen tank vent valve failed to 
reseat within the specified pressure range. This was found to be caused by 
pressure oscillations in the vent valve portion of the pressure-sensing system. The 
oscillations were eliminated by adding a double-orificed plenum chamber to the 
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va.ve pressure sensing system externa! to trie vaive mam nousmg. No ‘jr-e r 

problems were encountered. 

i .qn.fi Oxvaen Tank Mast P ercolation (unworkable, flight). During S-l 1-4 static 
firing at MTF, percolation of liquid oxygen tank mast caused a premature shutdown. 
Investigation revealed that presence of liquid in the annular section of the liquid 
oxygen tank pressurization mast caused an erroneous ullage pressure indication 
which ultimately led to termination of the firing. Resolution included hardware and 
operational changes to prevent the entrance of liquid into the mast annular section 
and to obtain accurate ullage pressure measurements. 


i im .id Oxvaen Fill and Drain Line Crac ked Bellows (unworkable, flight)- Post 
firing inspection of S-ll-2 at MTF detected a cracked pressure carrier bellows in the 
• *t ball joint of the liquid oxygen fill-and-drain line inboard of the GSE disconnect. 
Failure was attributed to flow induced vibration of the single ply bellows 
convolution. Redesign of the line assembly included addition of flow liners to all 
bellows and three ply bellows replaced all single ply bellows. There were no 
further problems with flow induced vibration in bellows on the S-ll program. 


AS-SD2 [ S-ll-21 Flight Anomaly (u nworkable, flight). During the Apollo 6 (AS- 
502) mission, the S-ll-2 stage experienced premature shutdown of two adjacent 
outboard engines (Engines 2 and 3). Post flight investigation attnbuted the cause 
of Engine 2 failure to breakage of the fuel line to the augmented spark igniter (ASIK 
Shutdown of Engine 3 was caused by closure of its liquid oxygen prevalve by the 
Engine 2 cutoff signal. The most probable cause for this anomaly was the cross- 
connection of the electrical connectors to the solenoids of liquid oxygen prevalve 2 
and liquid oxygen prevalve 3. 


Changes included redesign of both the fuel and oxidizer lines to the ASI 
assembly, revision of the engine checkout program at KSC to include individual 
prevalve checks, inspection of electrical wire harnesses on subsequent stages to 
uncover any incorrect or unclear electrical reference designators ( ERD )> 
reassignment of ERD as necessary to prevent misconnections, and installation of 
additional instrumentation to check the redesigned ASI lines. 


The J-2 fuel and oxidizer ASI line modifications were extensively tested in 
cluster firings on the Battleship. Over 1000 seconds of Battleship testing was 
conducted with the ASI line modifications installed on three engines. 

The new ASI lines were subsequently installed on S-ll-3 through S-IM^ The 
engine performance of these stages verified the adequacy of the ASI line design 

change. 

i im lid Oxygon Sumo Baffles (impro vement. flight). During sump screen 
replacements on the S-H-5, it was discovered that one Uqu id oxygen anti-vortex 
sump baffle had a tab sheared off. Similarly, two baffles in S-ll-3 and one baffle on 
the Battleship were found to have cracked tabs. The condition was attnbuted o 
high-cycle, low-stress fatigue. 
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Battlesmp tests successfully demonstrated that the sump baffles coula oe 
removed without impairing liquid oxygen drawdown. The go-ahead was given for 
removal of the sump baffles from flight stages S-ll-3 and subsequent. 

Liquid Oxygen Recirculation System (unworkable, orefliahtl . The Battleship 
boattail environment tests conducted at Santa Susana established the liquid 
oxygen recirculation system design and procedure to be used on all S-ll flight 
stages. Accomplishments included design and installation of an in-flight liquid 
oxygen helium injection system and stage and engine insulation. 

Liquid Oxygen Tank Vent Valve (unworkable. prefliahtL Liquid oxygen tank 
vent valve instability during venting and reseating operations were investigated on 
the Battleship stage. Modifications were made that proved to be stable. The 
modified liquid oxygen tank vent valves were acceptable for the flight S-ll stage. 

Depletion Sensors and ECO Time Delay Performance (workable, mod. 
expected, flight) . The maximum safe liquid oxygen and liquid hydrogen depletion 
cutoff time delays for use on flight vehicles were obtained. 

Vibration Study (unworkable, flight) . Comparisons were made between 
single-engine and cluster-engine vibration environments during firings on the 
Battleship stage to investigate repeated engine tube and component failure during 
Battleship testing. 

Control Line Modifications f unworkable, flight) . A series of Battleship firings 
was conducted to evaluate structural integrity of flight configuration modifications 
made to the main fuel valve, OTBV control lines, and the ASI liquid oxygen lines on 
all five Battleship engines. No hardware problems were noted with these changes. 


Liquid Oxygan/Liquid 


yen Vent Valves (unworkable. prefliahtL During a 


1 2-hour hold test on the Battleship, liquid oxygen and liquid hydrogen vent valve 
microswitches malfunctioned repeatedly under cryogenic conditions. Although the 
valves opened/closed as required, the open/closed indicators in these valves 
failed. 


Twelve-Hour Hold Environment Freeze Test (workable, oreftiahtl. A 12-hour 
hold test was conducted, simulating the KSC environment and using flight-type 
components. Analysis indteated that the propulsion system and components were 
capable of withstanding a 12-hour hold. 

Liquid Qxvoen Prevalve Relief Valve (unworkable, preflioht/fliohtl. During 
liquid oxygen tanking in support of liquid oxygen recirculation test ST-3, a piece of 
the liquid oxygen prevalve relief valve housing sheared off on Engine 5 liquid 
oxygen prevalve. Investigation revealed this was caused by contraction of the 
liquid oxygen tank during chilldown, pulling the liquid oxygen feed duct assembly 
into the cruciform. The relief valve was deleted from Engine 5 liquid oxygen 
prevalve. 
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L,auid Hydrogen Tank R upture (catastrophic, preflight/fliaht). The S-il-T rest 
stage was destroyed on May 28, 1966, when the liquid hydrogen tank ruptured 
during pressurization with helium. Failure resulted from propagation of a small 
fracture on a raised boss in cylinder 2 at a pressure below design ultimate. 

Liquid Hvdroaen/L iauid Oxygen Vent Valve Failures (unworkable. 
nrflfiinht/fliahtL During the S-ll-T test program, vent valve failures were numerous, 
although temporary in nature. The most common malfunction was the need for a 
long warmup period to open the cold-soaked vent valve after holding an override 
closed position. New design valves were provided for the flight stages. 

RF and Measurement Systems (unworkable. orefliaht/fliahtL Noise and 
random signals were noted in flowmeter and tachometer measurements. A new 
configuration plug-in module for flow and tachometer measurements were tested 
on the Battleship stage and produced acceptable flowAachometer data. 


ASl l i quid Qxvaen SuddIv Line Fatiou e ( catastrophic, orefliaht/fliohll. A full 
duration firing on S-ll-T was terminated 196 seconds after reaching mainstage. 
Engine 5 ASl liquid oxygen supply line ruptured causing a fire in the Engine 5 
area, which burned the mainstage OK pressure switch cable, causing the 
automatic engine cutoff. 
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APPENDIX 6 


SATURN V/SATURN IB S-IVB MAIN PROPULSION SYSTEM 


The S-IVB stage was the third stage of Saturn V and the second stage of 
Saturn IB (Figures 6-1 and 6-2). While the basic stage design for the two missions 
was the same, several design and operational features differed. The Saturn S-IVB 
stage with its single J-2 engine represented a unique "slice" of history for liquid 
cryogenic propulsion systems. Advanced technology was required for the 
development of such significant areas as engine start/re-start; propellant 
conditioning, containerization, pressurization, propellant slosh and utilization; 
thermal conditioning; engine shutdown; vacuum propellant dump; control systems 
and aborts. The "unknowns and leading-edge" technologies required were many 
for new stages using new J-2 engines (Figure 6-3) of 200,000 pounds thrust 
(vacuum) — which were later uprated to 230,000 pounds thrust. 

The S-IVB stage consisted of an aft interstage, an aft skirt, a thrust structure, a 
single gimbailed J-2 engine, a divided propellant container, and a forward skirt. 
The S-IVB/V and S-IVB/IB were similar. However, S-IVB/V translunar excursion 
mission configuration demanded a heavier payload and required engine restart 
capability, which necessitated certain structural and system changes. One major 
structural change was the much larger diameter aft skirt . 

Thrust Structure . The thrust structure was an inverted truncated cone attached 
at its large end to the aft dome of liquid oxygen tank and attached at its small end to 
the engine mount. The aft dome of the liquid oxygen tank was the lower portion of 
the propellant container (liquid oxygen and hydrogen tank assembly). The thrust 
structure provided the attach point for the center line mounted J-2 engine and 
distributed the engine thrust over the entire tank circumference. Attached external 
to the thrust structure were the engine piping, wiring, interface panels, eight high 
pressure helium spheres, hydraulic system, and certain engine and liquid oxygen 
tank instrumentation. 

Prnnfliiant Container . The divided propellant container (Figure 6-4) was an 
internally insulated cylinder with hemispherical bulkheads at each end and a 
common bulkhead to separate the lower tank of liquid oxygen from the liquid 
hydrogen tank above. This 21.7 foot diameter common bulkhead was a sandwich 
type construction consisting of two parallel, hemispherical shaped, aluminum alloy 
(2104-T6 A1) domes bonded to a fiberglass phenolic honeycomb core (1 3/4 ). 
The internal surface of the liquid hydrogen tank was a milled waffle pattern for tank 
stiffness and minimum structural weight. To minimize liquid hydrogen boiloff, 
polyurethane insulation blocks, covered with a fiberglass sheet and coated with a 
sealant were bonded into the milled areas of the waffle patterns in the liquid 
hydrogen tank. The liquid hydrogen tank volume was 10,418 cubic feet and the 
liquid oxygen tank volume was 2,830 cubic feet. 

Forward Skirt. The forward skirt was a longitudinally stiffened cylindrical 
structure which attached to the forward end of the propellant container and 
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FIGURE 6-1. SATURN IB S-IVB STAGE 




FI6URE6-2. SATURN V S-IVB STAGE 
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FIGURE 6— A. S-IVB STA6E PROPELLANT SYSTEM 
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supported the vahicle instrument unit 2 nd the Saturn Apollo payload. For safety 
the forward skirt area was purged with nitrogen from the vehicle instrument unit 
while propellants were being loaded or stored in the stage. 

Aft Inlfiisiaaa. The aft interstage for Saturn IB was a semimonocoque 
structure which supported the 21.7 foot diameter S-IVB second stage, the Saturn IB 
instrument unit, and the Apollo Spacecraft payload prior to first stage separation. 
The cylindrical aft interstage provided mounting facilities for four of the Thiokol 
30,000 pound thrust solid propellant retromotors with aerodynamic fairngs. Upon 
detonation, these retro motors provided a negative acceleration to the Saturn IB at 
the aft interstage/aft skirt interface. 

S-IYB/1B Aft Shift- The S-IVB/IB aft skirt was a semimonocoque structure 
which attached to the aft end of cylindrical portion of the propellant container and 
provided mounting hardware for three ullage motors. Three Thiokol 3390 pound 
nominal thrust solid propellant motors (TX-280) were equally spaced to provide a 
positive acceleration of the second stage to settle the liquid oxygen and hydrogen 
propellants for the J-2 engine one time start for Saturn IB usage. Two diametrically 
opposed attitude control modules were attached to the aft skirt. Each of these 
attitude control modules contained the three TAPCO 150-pound thrust (vacuum), 
hypergolic (MMH and N 2 O 4 ) rocket engines. 

S-IVB/V Aft Skirt. The S-IVB/V aft skirt was a truncated cone that provided the 
load support structure between the S-IVB stage and the 33-foot diameter S-ll stage. 
The structure was of aluminum skin panels externally stringer-stiffened, riveted 
construction bolted to the S-IVB aft skirt and the S-ll forward skirt. The aft skirt 
provided the focal point for the required electrical and mechanical interface and an 
envelope for the aft environmental control. Retrorocket motors were attached to 
this interstage and at separation, the interstage remained attached to the S-ll stage. 

J-2 Engine . The S-IVB/IB single bum of the single J-2 engine, with 200,000 
pound thrust, occurred immediately after the S-IB stage burn was completed and 
S-IVB/S-IB stage separation. The S-IVB/IB placed the vehicle instrument unit (IU) 
attached to the Apollo payload into orbit Similarly, the S-IVB/V first bum of the J-2 
engine occurred immediately after S-II/S-IVB stage separation and lasted long 
enough to insert the vehide into earth orbit. Approximately two to four hours later, 
the second bum of the J-2 engine injected the S-IVB instrument unit/spacecraft into 
a translunar trajectory. During burn periods, the vehicle control was provided by 
the J-2 engine which gimballed ± 7.0 degrees in a square pattern powered by a 
hydraulic actuator control system. 

The J-2 engine was a high performance multiple restart engine using liquid 
oxygen and liquid hydrogen as propellants. The engine attained a thrust of 
approximately 200,000 pounds. The only substances used in the engine were the 
propellants and helium gas. The extreme low operating temperatures prohibited 
the use of lubricants or other fluids. The engine featured a single, tubular-walled, 
bell-shaped thrust chamber and two independently driven, direct drive, turbopumps 
for liquid oxygen and liquid hydrogen. Both turbopumps were powered in series by 
a single gas generator, which used the same propellants as the thrust chamber. 
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The mam r.yaraulic pump was driven by the oxidizer turbopump turbine, 
of fuel to oxidizer was controlled by passing liquid oxygen from the 
turbopump to the inlet side through a servo valve. 


The ratio 
oxioizer 


The engine valves were controlled by a pneumatic system powered bv 
gaseous helium which was stored in a sphere inside the start bottle. An electric 

st°a n rr r 3 nrt^ S h e ^n WhlCh US ? d SOlld state logic elements - was used to sequence the 
start and shutdown operations. M 


hoi,um U th? 9 t ^ 0 ^ bU I n ’ the iiquid ox y9 en tank wa s pressurized by flowinq cold 
h , through the heat exchanger in the oxidizer turbine exhaust duct. The liquid 

chlX n ,^ k m ^o,r sunzed durin9 burn P9r,0ds 6y hyc,r09en ,rom ,he ,hrus ' 


The restart of the S-IVB/V J-2 engine was identical to the initial start. 

He l ium StQragfi - Helium was stored in nine cold helium spheres located in 
the liquid hydrogen tank, eight ambient helium spheres mounted on the thrust 
structure, and one sphere located inside the start bottle on the engine. The nine 
‘? dh ?' lu "I spheres supplied cold helium for pressurization and repressurization 
of the liquid oxygen tank and repressurization of the liquid hydrogen tank. Five of 
the eight ambient helium spheres provided an alternate source of helium for 
repressunzation of the liquid hydrogen tank, two provided an alternate source of 
helium for repressunzation of the liquid oxygen tank, and one provided pressure for 
operation of the stage pneumatic controls. The engine could control which helium 
sphere provided pressure for operation of the engine controls. 

Liq u i d Oxygen System - Liquid oxygen was stored in the aft tank of the 
propellant tank structure (Figure 6-5) at a temperature of -297 degrees F Total 
volume of the tank was approximately 2830 cubic feet with an ullage volume of 
approximately 108 cubic feet. The tank was prepressurized between 38 and 41 
psia and was maintained at that pressure during boost and engine operation 
Gaseous helium was used as the pressurizing agent. 


The Iiquid oxygen fill-and-drain valve was capable of allowing flow in either 
direction for fill or drain operations. During tank fill, the valve was capable of 
flowing 1000 gpm of liquid oxygen at an inlet pressure of 51 psia. Pneumatic 
pressure for operating the fill-and-drain valve was supplied by the stage pneumatic 
control bottle. 


Pressure switches were used to control the tank pressure during fill, in the 
event of tank overpressurization (41 psia) the pressure switch sent a signal to close 
the Iiquid oxygen ground fill valve. 

Liquid oxygen tank pressurization (Figure 6-6) was divided into three basic 
procedures. These procedures were called prepressurization, pressurization and 
repressunzation. The term prepressurization was used for that portion of the 
pressunzation performed on the ground prior to liftoff. The term pressurization was 


6-7 



UMBILICAL 

UMBILICAL 

LOX FILL & 
DRAIN VALVE 



OVERBOARD 

VENT 

VENT RELIEF & 
RELIEF VALVE 


PRESS INLET 


ANTI VORTEX 
SCREEN 


LOW PRESS 
DUCT ASSY 


FIGURE 6-5. S-IVB STAGE LOX SYSTEM COMPONENTS 
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FIGURE 6-6. S-IVB STAGE LOX PRESSURIZATION SYSTEM 




usea :z ;naicate pressurization during engine burn perioas, and iashv 
repressurization indicated pressurization just before a burn period. 


The pressurant used during the three liquid oxygen tank pressurization 
procedures was gaseous helium. Cold helium from a ground source was used 
during the prepressurization period. This ground source of cold helium was also 
used to charge the nine cold helium storage spheres. The cold helium storaae 

^ o n ® reS ’i 0CateCl J n thG liquid h y dr °9® n tank - supplied cold helium for both the 
ur, J a J l0n and repressurization periods. A hydrogen/oxygen burner was used 
to neat helium gas supplied from the cold storage spheres. The ambient helium 

h^M?m^nr Pher0 H' f ' lled by ground su PP ort equipment, were the alternate source of 
helium for use during repressunzation prior to the first and second burns. 

The liquid oxygen tank pressure was controlled by the flight control pressure 

7 ,he P's^fation procedure used These switches cKed 
solenoid shutoff valves in each of the supply subsystems. 

The liquid oxygen tank vent subsystem provided for controlled liquid oxygen 
tank venting during normal stage operation and for pressure relief venting when 
tank overpressures occurred. The liquid oxygen tank venting subsystem included 
a propulsive venting vent and relief valve and a latch open non-propuisive vent 

ground command rel ' 0f ValV ® W3S P neumatical, y operated upon receipt of a 


Successful engine start required the liquid oxygen pump and related 
hardware to be at liquid oxygen temperature and that all oxygen available for 
consumption be single phase and satisfy specific requirements. This was 
accomplished by a small pump and valve in a fluid circuit about the feedline 
prevalve. With the prevalve closed, oxygen from the tank was forced through the 
feedline, the engine, and a small return line connecting the engine and oxygen 
tank. The system operated prior to launch and during powered flight until engine 
ignition. For the orbital restart mission, a similar sequence was used, however 
pumping was not initiated prior to ullage rocket firing. This ensured continued 
oxygen availability to the small pump. 


LlQUld Hydrogan System. The liquid hydrogen (Figure 6-7) was stored in an 
insulated tank with a total volume of approximately 10.400 cubic feet with an ullage 
volume of approximately 300 cubic feet. The liquid hydrogen tank was 
prepressurized to 28 psia minimum and 31 psia maximum. 

Prior to loading, the liquid hydrogen tank was purged with helium gas. At the 
initiation of loading, the ground controlled combination vent and relief valve was 
opened, and the directional control valve was positioned to route hvdroaen 
overboard to the bum pond. 7 y 


Liquid level during fill was monitored by means of liquid hydrogen mass 
probes. A backup overfill sensor was provided to terminate flow in the event of a 
100 percent load cutoff failure. Pressure switches controlled the tank pressure 
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FIGURE 6-7. S-IVB STAGE FUEL SYSTEM COMPONENTS 
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during iiil. In tne event of tank over pressurization (31 psia), the pressure switch 
sent a signal to close the liquid hydrogen ground fill valve. 

Liquid hydrogen tank pressurization (Figure 6-8) was also divided into 
prepressurization, pressurization, and repressurization procedures similar to the 
liquid oxygen tank. 

The pressurants used during the three liquid hydrogen tank pressurization 
procedures were gaseous hydrogen (hydrogen) and gaseous helium. Cold helium 
from a ground source was used during the prepressurization period. The cold 
helium storage spheres (2), located in the liquid hydrogen tank supplied cold 
helium for use during the repressurization period. The five ambient helium storage 
spheres filled by ground support equipment supplied an alternate source of helium 
for use during the repressurization period. 

The liquid hydrogen tank pressure was controlled by the flight control 
pressure switch regardless of the pressurization procedures used. This switch 
controlled solenoid shutoff valves in each of the supply subsystems. 

The liquid hydrogen tank vent subsystem was equipped to provide either 
propulsive or non-propulsive venting. Non-propulsive venting was the normal 
mode used, except for the Saturn V S-IVB orbital mission. During the two to four 
hours the vehicle was in earth orbit, excluding approximately five minutes prior to 
engine start, hydrogen gas from the tank was vented propulsively. This was 
necessary to keep hydrogen "settled’ to avoid venting liquid hydrogen, thus 
preserving hydrogen for the engine second bum mission. 

Similarly, as for oxygen, successful engine start required a cold engine 
hydrogen pump and related hardware and acceptable propellant for consumption. 
A similar system to the oxygen system was used. 

S-IVB PROPULSION SYSTEM TEST OBJECTIVES 

The major objectives of the S-IVB stage for both Saturn V and IB missions are 
presented. Both battleship and all system vehicle configurations were involved, 
and the objectives apply to each as appropriate. There were a total of 24 firing 
attempts, excluding altitude testing, which was conducted in a test chamber located 
at the Arnold Engineering Development Center and later S-IVB testing at the 
MSFC. Test objectives follow: 

• Determine structural acceptability of engines and vehicle hardware in the 
propulsion system test environment 

• Determine functioned capability of engines and vehicle hardware in the 
propulsion system test environment 

• Validate engine-imposed vehicle design requirements 

• Validate vehicle/propulsion system imposed engine requirements 
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FIGURE 6-8. S-IVB STAGE FUEL PRESSURIZATION SYSTEM 
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♦ Determine :,ne engine ana vemcie naraware propellant leakage integrity 

Validate the functional capability of the engine and vehicle electrical hardware 
and instrumentation 

Determine functional compatibility of vehicle structure, fluid, electrical, and 
hydraulic systems with the ground/GSE interfacing systems 

• Establish adequacy of operating procedures 

Verify thermal and structural adequacy of the stage insulation 

Demonstrate acceptable operations and adequacy of all systems to satisfy 
requirements 

S-IVB TEST ACCOMPLISHMENTS 

Following is a list of accomplishments achieved by the S-IVB propulsion 
system test program. Each issue has been classified as to consequence and time 
phasing for which the issue may apply, as was done in Appendix 3 for Space 
Shuttle. 

Recirculation System 

Recirculation Pump Destruction ( unworkable ■ orefliohti . Electrically driven 
vehicle located pumps, one oxygen and one hydrogen pump, were utilized to 
circulate small quantities of each propellant through the engine and respective 
feedline to remove heat and provide acceptable quality propellants in each 
feedline at engine start. During tank inerting prior to propellant loading and tank 
blowdown post firing, these pumps were frequently run as a turbine (wrong 
direction) at excessive speeds thus damaging pump bearings and inverters and 
necessitating hardware changeout. This required addition of protective braking 
devices to the pumps and extensive changes to procedures. 

Liquid Hydrogen Pumo Chill Procedure /catastr ophic • flight!. Early battleship 
testing indicated the potential for liquid hydrogen pump stall during the initial phase 
of J-2 engine start. Engine start for S-IVB/1 B and first start for the S-IVB/V was 
approximately 2 and 1 1 minutes after liftoff respectively. S-IVB/V was restarted 
several hours after liftoff . Potential consequences were that the engine would fail 
to start and mission failure would result. Turbopump chill procedures were 
changed and validated. 

Thrust Chamber Chill Down (catastrophic - flight!. Early battleship firings 
satisfied the engine supplier's thrust chamber start requirement of 260 ± 50 
degrees Rankin; however, further testing discovered that the requirement was 
inadequate to assure a satisfactory start in all circumstances. Extensive additional 
tests were necessary to explore a number of other variables to assure satisfactory 
start in the various vehicle environments. Some variables were liquid hydrogen 
lead time, helium supply quantities and supply conditions. 
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System Evaluation of S-IVB Liquid Hydrooen/Liauid Oxygen Engine and 
Feedlines Chilldown Systems (catastrophic - flight) . The performance of the 
systems provided for chilldown of the engine and feed ducting for both the liquid 
hydrogen and oxygen propellants were of utmost importance to stage operations 
and mission success. Performance of each system was sensitive to the 
environment, to stored energy of the appropriate vehicle lines and the engine, and 
to the quality of the S-IVB stage and J-2 engine propellant line and pump 
insulations which controlled heat flow to the engine. Each design utilized electric 
driven pumps as the fluid "driver". Systems were required to operate at gravity 
levels of one, greater than one and significantly less than one thus complicating 
design and verification. Extensive system testing was necessary to support 
detailed analysis for the S-IVB initial start and particularly the restart mission wmch 
occurred near zero gravity. A special orbital flight experiment was necessary to 
confirm acceptable system operation along with other test objectives. Specific 
issues to resolve were many: (1) removal of sufficient engine heat: (2) maintain 
only liquid propellant within the feedline at engine start; and (3) accomplish the 
above without reorienting propellant within tankage. 

Pressurization System 

Liquid Hydro gen Pressurant Diffus er (catastrophic - flight) . The initial 
pressurant diffuser design for the hydrogen tank of S-IVB/1 B and V resulted in tank 
pressure decay during tests. The diffuser created excessive gas velocities at the 
liquid gas interface which reduced/destroyed the stratification layer near the liquid 
surface. The diffuser was enclosed within a woven nylon bag which uniformly 
diffused the high velocity gas and resolved the issue. To achieve a structurally 
sound bag, more than one bag and test was required. 

Qxvgen/Hydrogen Burner Integration (catastrophic - flighty The 
oxygen/hydrogen burner was utilized to heat cold helium gas for repressurizing the 
liquid oxygen and hydrogen tanks for approximately 8 minutes prior to S-IVB/V 
restart in earth orbit. Problems were encountered during component development 
and significant problems were experienced during integration and system 
verification. A similar device termed "the helium heater” had been previously 
developed and used on the S-IV stage for oxygen tank pressurization during 
powered flight and many of the same/similar problems were experienced. For S- 
IVB/V, ignition occurred near zero gravity in a vacuum and in a thermal 
environment which could only be estimated. Quantities of helium gas required 
were influenced by heat transfer mechanisms within the hydrogen and oxygen 
tanks and the heat transfer from external surroundings to the vehicle which in turn 
were influenced by vehicle orientation, timing for vehicle start, surface properties, 
insulation thermal conductivity, etc. Problems encountered in integration are too 
numerous to discuss herein; however vehicle "system" tests are necessary to 
identify many of the problems and to collect important data to resolve problems. 
The alternative to the oxygen/hydrogen burner is many ambient temperature 
storage containers filled with 4500 PSI helium gas. 
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fact. Whue hardware changes were not required, extensive analytical moaei 
changes and stage design parameter reassessments were necessary. 

Pmnellarn Management 

Propellant Management (catastrophic • flight!. This subject includes loading 
a specified propellant quantity, consumption of a specified propellant quantity, 
maintaining necessary reserves for safe shutdown and mathematically 
representing rocket engine performance accurately for predicting total vehicle 
performance. The static firing program was essential for developing and or 
verifying the involved hardware and procedures. The S-IVB stage utilized active 
propellant management systems for controlling propellant consumption during 
flight. These systems utilized mass probes (capacitor) and the probes were also 
used for loading. Propellant depletion sensors were used for assunng controlled 
engine shutdown. A quantity of each propellant is not useable for engine 
consumption for various reasons. This quantity must be minimized and must be 
known. The quantity of propellant which a tank may store is influenced by 
accumulative tolerance during construction and dimension of changes resulting 
from thermal expansion and applied loads. Tank calibration by some means is 
necessary. Propellant management is thus a broad, complex, and major task 
which must be developed and carefully verified. The flight vehicle configuration is 
the best source for development and verification of subject system, analytical tools, 
and procedures. Problems with development and verification of the propellant 
management systems were numerous and changes were required in hardware, 
analysis techniques, and operational procedures. Emphasis on individual issues 
and problems experienced would be counter productive because of the breadth of 
the verification activity. 

Available Rocket Engine Pump Inlet NPSP (catastrophic, flight). Rocket 
engine pumps require a minimum NPSP to operate properly. Available NPSP is 
dependent upon many parameters: (1) tank pressure; (2) propellant temperature; 
(3) pressure drop of the propellant in the feedlines between the tank outlet and 
pump inlet; and (4) propellant liquid head. Propellant temperature is dependent 
upon three variables for a particular propellant: (1) heat entering the propellant; 
(2) initial temperature of propellant which depends upon propellant tank vent 
system back pressure and propellant head; and (3) the stratification characteristics 
of the propellant near the surface at the liquid/gas interface. All parameters are 
important objectives of any vehicle design and verification program. Stage system 
testing required procedure changes, hardware design changes, and hardware 
changeout. Excessive high insulation thermal conductivity required propulsion 
system re-evaluation. Vent system back pressure is a critical parameter, 
particularly for hydrogen propellants which must be ducted and burned. This area 
is always eventful as characteristics of launch site disposal for hydrogen burn 
ponds differ from burn stacks normally used on verification sites. Feedline 
pressure loss, while seemingly routine, must be accurately known to verify design 
estimates and the "end-to-end values" needed are rarely available from other 
sources. The parameters not discussed in detail are likewise important and must 
be thoroughly understood. 



Miscellaneous 


Compartmgnt/EQuiDment Hazardous G as and Thermal Control fcatastmnhir - 
^iqhf). An engine gas generator fire and explosion occurred at ignition on the 
Battleship. The cause was gas generator failure due to low hardware temperature 
resulting from long exposure to surrounding cold hardware and inadequate local 
compartment purges for thermal control and inerting. This is one issue of many 
involved m development and system testing for controlling hazardous gas (for 
engine compartments and inner stage areas) to acceptable concentration levels, 
systems for monitoring concentration levels, thermal control of propulsion and 
electronics equipment and necessary thermal measurement systems. Restart from 
earth orbit after several hours exposure complicates thermal control. A heater 
blanket was the fix" for the gas generator problem. Most electronics were mounted 
on cold plates and temperatures were controlled by active systems, thus avoiding 
the difficulties of some propulsion hardware. 3 

Liquid Hydrogen Leak Detection (wori< able - oref light v Propellant leakage in 
closed or vented compartments is a critical issue. Liquid hydrogen propulsion 
component leakage on S-IVB Battleship resulted in an explosion and fire during 
the first S-IVB/V firing. S-IVB/V battleship was a conversion from the S-IVB/1B 
configuration. Saturn V and S-IVB/V had approximately 7000 and 400 fluid 
connectors respectively as leak sources. Demonstration of leak free hardware is a 
prime objective of system testing. 

Propulsion System Ductino/Vent Val ves (unworkable - flinht orefliahtl. 
Hardware problems necessitating changeout and design change were frequent 
occurrences for both the hydrogen and oxygen systems. The Battleship program 
identified many and assisted in the resolution. Some of the many issues follow: 

a. Environmental factors caused liquid oxygen tank vent valve signal 
irregularities during venting and pressurization functions. Bench tests 
indicated normal operation. Redesign was required. 

b. Environmental conditions caused liquid hydrogen fill-and-drain valve position 
feedback irregularities during loading and unloading. Bench tests indicated 
normal operation. 

c. The liquid hydrogen feedline inner liner failed, wrinkled, or collapsed, during 
Battleship testing. Initial. failures discovered early in the program were in the 
upper line section. The duct was redesigned using a triple ply liner. In 1969 
during Battleship testing at MSFC, similar failures occurred in lower sections 
of the feedline. This section had not been redesigned earlier. The lower line 
failures are life type issues versus basic design deficiencies for upper lines 
observed early in the program. 

d. The liquid hydrogen feed duct utilized vacuum jacketed ducting to reduce 
heat input to the propellant. The loss of vacuum and thus its thermal 
insulation characteristics was a frequent occurrence during Battleship testing 
and early vehicle acceptance firings. Vacuum loss resulted from leaking of 
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;ne rupture disk ana crack failures of the bellows. The vemcie reauirea 
frequent servicing to maintain the necessary vacuum, and haraware 
cnangeout was often necessary. Continual working with suppliers of the 
cucting was necessary for satisfactory resolution. 

Late Battleship Tests 

In late 1968 and 1969, Battleship testing was resumed at MSFC. Primary 
emphasis was mission enhancement/safety/improvements. Five issues from 
subject testing are included. For reference, Apollo 8, first manned Saturn V. flew in 
December 1968 to the vicinity of the moon. 

Engine Start Tank Recharoe in Orbit (i mprovement - flight). A leaking engine 
start tank system could jeopardize successful stage restart from earth orbit. Stan 
tank repressurization from the stage repressurization gas system was investigated 
and verified. 

Engine Structural/Propuls ion System Interactions (unworkable - flights The 
S-ll stage center engine of Flight 503 experienced structural oscillations at a 
frequency of approximately 18 Hertz. The validity of pump pressure transfer 
functions which had been used in analyses to determine vehicle stability were of 
concern, November 1988. A hydraulic driven pulser was installed on the oxygen 
feedline of the S-IVB Battleship to input pressure oscillation and study transfer 
functions of the feed system/J-2 engine. Test data revealed the engine 
manufacturer supplied data, which had been used in structural/propulsion system 
dynamic analyses, were incorrect. The data were collected to support S-ll stage 
development. Structural/propulsion interaction was not an S-IVB problem. 

Helium Pressurization Shut-Off Valve Failu re (unworkable - flight). The cold 
helium pressurization storage system shut-off valve failed to close during the 
countdown demonstration test in S-IVB-503 at KSC. The replacement pressurizing 
control module and alternate or backup modules for several vehicles were 
cryogenically tested on S-IVB Battleship prior to designated usage. 

Liquid Qxvoen Vent and Relie f. Relief Valve Failure Due to Freezing 
(imwnrkahifl - flinhtv Battleship testing determined thermal operational/hardware 
problems. Tests were conducted to determine if the liquid oxygen vent and relief 
valves would both freeze in the closed position or operate in a cyclic mode (freeze- 
thaw, freeze-thaw, etc.), with failure of the cold helium shut-off valves. Freezing did 
occur. 

Liquid Hydrogen Propellant Tank Drainage (imp rovement • flight). A liquid 
hydrogen feed duct collector manifold to improve utilization of residuals was tested 
in the MSFC S-IVB Battleship. The large screen section of the collector manifold 
collapsed at specification conditions. 

Note: There was no all-systems vehicle for S-IVB. Also, the battleship program for 
S-IVB/V was extremely short in duration-approximately 1 week. It was 
shipped to MSFC for some testing, then to Tullahoma, Tennessee for 
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APPENDIX 7 


SATURN I, S-l STAGE AND SATURN IB, S-IB STAGE 
MAIN PROPULSION SYSTEM 


S-l and S-IB stages were the first stages of the Saturns I and IB launch 
vehicles respectively (Figure 7-1). Both were designed and developed principally 
by the MSFC. The S-IB stage was an improved S-l stage primanly to achieve 
increased performance capability. Because of the similarity of the two designs 
most development testing was conducted with the S-l stage configuration (Figure 
7-2). Figures 7-3 through 7-7 provide insight relative to the stage configuration and 
important system designs. 

The S-l stage was fueled by liquid oxygen/RP-1 fuel. Thrust was provided by 
eight H-1 engines which initially produced a thrust of 165,000 pounds each. The 
engines were arranged in a cluster of four inboard and four outboard engines. The 
four outboard engines could be gimballed in both pitch and yaw to provide thrust 
vector control. 

The stage used clustered cylindrical tanks for fuel and oxidizer storage. The 
tank arrangement was such that four 70-inch diameter fuel tanks, alternating with 
four 70-inch diameter oxidizer tanks, were clustered around a 105-inch diameter 
center oxidizer tank. Each of the four fuel tanks fed two engines, yet were 
interconnected with the other tanks. The center oxidizer tank provided series flow 
to the four outboard oxidizer tanks, which also fed two engines apiece. 
Pressurization of the oxidizer tanks was done by a heat exchanger from each 
engine which produced gaseous oxygen which was collected and ducted to the top 
of the center oxidizer tank and subsequently to individual tanks. Gaseous nitrogen 
from 48 fiberglass spheres mounted at the top of the stage pressurized the fuel 
tanks. This was later changed to a helium system which included two helium 
storage bottles mounted to the top of the stage. 

The cluster of tanks was held together at the base by the tail section and at the 
top by a structural component known as the "spider beam". The tail section 
consisted of the thrust structure assembly as well as the heat shield, shrouding for 
engine components, holddown points, stabilizing fins (on later S-l and S-IB 
stages), and other components. 

A test booster called SA-T was manufactured for use in the propulsion system 
test program. The SA-T booster was modified throughout the program to keep it 
updated to the current flight configuration. As soon as a flight booster completed its 
acceptance test series and was shipped to Cape Canaveral, the updated SA-T was 
installed into the test stand for verification of the next flight configuration. 

In most respects, the S-IB stage retained the size and shape of its S-l 
predecessor. The upper area was modified to take the larger diameter and heavier 
S-IVB stage, and the aerodynamic fins were redesigned for the longer and heavier 
vehicle. The thrust of the H-1 engines was increased to 200,000 pounds each, and 
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SEPARATION 


FIGURE 7-1 
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TELEMETRY ANTENNAS (2) 



DIAMETER 6.5 METERS (21.4 FT) I 

LENGTH 24.4 METERS (60. 2 FT) 

■EIGHT 452,240 KILOGRAMS (997,000 LBS) FUELED 
38,347 KILOGRAMS (84,540 LBS) ORY 
ENGINE H-1 (8) 

PREPELLAMTS: LIQUID OXYCEN 252,115 LITERS (66,609 GAL) 
RP-1 (KEROSOC) 156,037 LETERS (41,225 GAL) 
TTMUST 7,294,700 NEWTONS (1,640,000 LBS) 

CONTRACTOR: OKYSLER CORPORATION 


FI6URE7-2. S-I/IB STA6E CONFIGURATION 
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later to 205,000 pounds. There was no ground test stage since the S-IB was so 
similar to the S-l that a separate ground test program was not necessary The S-IB 
stage configuration is depicted in Figure 7-2. 

S-IB stages were manufactured at the Michoud Assembly Facility by the stage 
contractor, Chrysler Corporation Space Division. After checkout, they were 
transported by barge to MSFC, where a number of systems tests were performed. 
This test series consisted of simulated flight tests, a propellant loading test, short 
duration firing (approximately 35 seconds), and a full duration firing (135-145 
seconds). A total of 34 hot-fire tests were performed on the 12 stages including 
four special combustion instability tests performed on stage S-IB-1 1 . ' 

Stage Propallant System- The stage propellant system (Figure 7-3) was 
composed of five liquid oxygen tanks, four RP-1 fuel tanks, propellant lines, control 
valves, vents, and pressurization subsystems (Figures 7-4 and 7-5). The sumps of 
each group of tanks were interconnected to provide uniform propellant levels and 
pressures. Loading of liquid oxygen and RP-1 fuel tanks was controlled by ground 
computers. After the RP-1 fuel had been loaded and just before the start of liquid 
oxygen loading, ground source nitrogen was bubbled through the RP-1 fuel suction 
lines to prevent temperature stratification. At the start of the automatic sequence, 
the RP-1 fuel tanks were pressurized with ground source nitrogen. During stage 
burn, fuel tank pressurization was maintained by helium from two 20-cubic foot 
spheres located above two of the fuel tanks. Ground source helium was bubbled 
through the liquid oxygen lines and tanks at the start of the automatic sequence to 
prevent temperature stratification in the engine liquid oxygen suction lines. Prior to 
engine ignition, the bubbling was discontinued and the liquid oxygen tanks were 
pressurized with helium from a ground source. After liftoff, the liquid oxygen tank 
pressurization (Figure 7-6) was maintained with gaseous oxygen from heat 
exchangers. 

H-1 Engine Operation {Figure 7-fiT A start signal ignited the solid propellant 
gas generator (SPGG) which accelerated the liquid oxygen and RP-1 fuel pumps. 
Increasing fuel pressure opened the main oxidizer valve which, in turn, opened the 
sequence valve permitting fuel pressure to rupture the hypergolic cartridge. 
Primary ignition occurred when the RP-1 fuel and hypergolic fluid contacted liquid 
oxygen in the thrust chamber. The injector fuel pressure opened the main RP-1 
fuel valve and provided propellant flow to the liquid propellant gas generator 
(LPGG) which sustained turbine operation. 

When the predetermined propellant level was sensed (within 1.8 seconds), 
the digital computer initiated inboard engine cutoff. Outboard engine cutoff was 
initiated by either the thrust OK switches, the backup timer (from the computer), or 
the fuel depletion probes. Both cutoff signals were routed through the stage switch 
selector. The cutoff signals opened the explosively actuated Conax valve 
equalizing the RP-1 fuel pressure at the main oxidizer valve. The valve closed to 
interrupt fuel flow and terminate engine operation. 
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OPEN - 67.5 psia 
CLOSE - 64 psia 


COX VENT 4 
RELIEF VALVES 


RELIEF 

60 psig 
53.0 psig 


50 psig 

NON 


OUTER LOX TANK (4) 
97,700 LBS EA 
AT LIFTOFF 


LOX TANK 1 
220,500 LBS I 
AT LIFTOFF 



GN./Hc 

kig 



20 CU FT 

He SPHERES (2) 
FOR RP-1 TANK 
PRESSURIZATION 


► VENT 4 SAFETT VALVES 
VENT SAFETT 

OPEN - 21 psig 23 psig 

CLOSE - 19 psig 21 psig 


.RP-1 TANK { 4 ) 

— 68,280 LBS EA 
AT LIFTOFF 


LOX BELOW CONTAINER 
BOTTOM AT LIFTOFF 
- 8,500 LBS v. 


LOX FILL 4 DRAIN « 


GH» FROM GSE FOR 
INITIAL LOX TAMC 
PRESSURIZATION 


/ 



RP-1 BELOV CONTAINER 
BOTTOM AT LIFTOFF 
• ~ 5,000 LBS 

- RP-1 FILL i ORAIN 


HEAT EXCHANGER 
PRODUCES COX FDR 
INFLIGHT PRESSURIZATION 


H-1 EMCINE (8) 


FI6URE7-3. S-I/IB PROPELLANT SYSTEM 
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FIGURE 7-4. S-I/IB LOX PRESSURIZATION SYSTEM 
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RP-1 


. 0 . 



200,000 LBS THIUST 


FIGURE 7-6. H-l ENGINE SYSTEM 
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CANTED OUTBOARD 3* 

FIGURE 7-7. S-I/IB THRUST VECTOR CONTROL SYSTEM 
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Stage Thrust Vector Control System (Fig ure 7-7) . Each of the four outboaro 
H-1 engines was gimbal mounted on the stage thrust structure to provide engine 
thrust vectoring for vehicle attitude control and steering. Two hydraulic actuators 
were used to gimbal each engine in response to signals from the Flight Control 
Computer located in the Instrument Unit. 

The actuators were part of an independent hydraulic system on each 
gimballed engine. Hydraulic fluid flowed to the actuators from the high pressure 
accumulator and returned to the low pressure reservoir. An electric motor anven 
auxiliary pump operated only during pre-launch checkout of the thrust vector 
control system. 

Detail information on all aspects of the S-l and S-IB test and flight program is 
included in Table 7-1 and 7-2 of this appendix. The material is included both for 
information and historical purposes. Summary information on test program 
accomplishments includes appropriate information from this table and other data 
sources. 

SATURN S-I/S-IB STAGES 
S-I/S-IB Test Objectives 

The S-I/S-IB test objectives were initially developed to demonstrate the 
feasibility of clustering a number of rocket engines and fuel and oxidizer tanks as a 
means of providing large thrust launch vehicles. Objectives were later added to 
demonstrate the capability for flight of the stage. Additional objectives were added 
as the test program evolved. Some of the major objectives were as follows: 

• Evaluate H-1 engine performance in a clustered configuration 

* Evaluate clustering of several tanks as flight storage containers for propellants 

* Evaluate stage hydraulic system 

* Evaluate stage thrust vector control system 

• Evaluate performance of propellant fuel supply systems 

• Evaluate performance of propellant pressurization systems 

• Evaluate performance of aft compartment flame and heat shields 

* Evaluate performance of propellant loading systems 

• Evaluate performance of engine rough combustion cutoff system 

* Evaluate capability of GSE to support vehicle launch operations. 


7-10 



Table 7-1. Saturn I Static and Flight Test Information 
from 03/28/60 through 12/20/60 (Sheet 1 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 03/28/60 through 12/20/60 (Sheet 2 Of 2) 
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Table 7- 1. Saturn I Static and Flight Test Information 
from 01/31/61 through 02/14/61 (Sheet 1 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 01/31/61 through 02/14/61 (Sheet 2 Of 2) 




Table 7-1. Saturn I Static and Flight Test Information 
from 04/29/61 through 07/18/61 (Sheet 1 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 04/29/61 through 07/18/61 (Sheet 2 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 08/03/61 through 08/25/61 (Sheet 1 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 08/03/61 through 08/25/61 (Sheet 2 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 10/10/61 through 02/06/62 (Sheet 1 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
02/20/62 (Sheet 2 Of 2) 
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Table 7- 1. Saturn I Static and Flight Test Information 
from 04/10/62 through 07/17/62 (Sheet 1 Of 2) 
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Table 7 - 1. Saturn I Static and Flight Test Information 
from 04/10/62 through 07/1 7/62 (Sheet 2 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 09/1 1/62 through 09/26/62 (Sheet 2 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 10/26/62 through 03/27/63 (Sheet 1 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 10/26/62 through 03/27/63 (Sheet 2 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 10/02/63 through 10/22/63 (Sheet 1 Of 2) 
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Table 7-1. Saturn I Static and Flight Test Information 
from 10/02/63 through 10/22/63 (Sheet 2 Of 2) 
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Table 7.2. Saturn SI/IB Static Test Information 
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These objectives were evaluated and specific objectives to be satisfied during 
each individual tests were carefully factored into the test plan for that test. A total of 
31 development static firings were made during the S-I/S-IB program. 


S-I/S-1B Test Accomplishments 


The major accomplishment contributed by the Saturn SI/S-IB program all- 
system firings was verification that the clustered engine and tank concept for 
providing large thrust launch vehicles was feasible. 

Specific accomplishments obtained from the S-I/S-IB propulsion system test 
program are presented in the following paragraphs. Each issue has been 
classified as to consequence and time phasing for which the issue may apply as 
was done in Appendix 3 for Space Shuttle. 


Frupine Puroe Sequence (workable , mod, expected, fliqhtl- The H-l engine 
used a hypergolic substance to lead the RP-1 fuel into the combustion chamber to 
establish ignition with the liquid oxygen before the fuel entered the chamber. A 
cutoff sequence had been established which initiated a hypergol purge at 100 
milliseconds after cutoff signal. It was determined that the 100 millisecond purge 
was forcing hypergol into the main fuel valve actuators on the four inboard engines 
resulting in slow closing times for the valves. The hypergol purge sequence was 
changed to two seconds after cutoff which eliminated the slow main fuel valve 

closing problem. 


Innitinn Dfllavs on Solid Propellant G as Generators (unworkable. PrefliqhO - 
The H-l engine used a solid propellant gas generator (SPGG) for the initial spin-up 
of the turbopumps prior to liquid oxygen/RP-1 ignition in the gas generators. 
During the test program, problems with SPGG ignition delays, or hang fires, was 
experienced. It was determined that the delays were caused by igniter pellet 
shifting due to a weak cover. The cover was redesigned and the problem solved. 

Fi ifli Temperature Stratific ation (catastrophic, prefliqbi). The H-l engine start 
sequence was extremely sensitive to mixture ratio of propellants during gas 
generator ignition. A mixture ratio that was too liquid oxygen rich could be 
destructive to the turbopump turbine blades. Controlling the temperature of the fuel 
at the pump inlet was vital. It was determined that temperature stratification of the 
fuel could be prevented by bubbling the fuel with gaseous nitrogen injected into the 
fuel feedline for each engine. 


I im lid Oxvaen Pump Inlet Temperatur es /catastrophic, orefliqht). The Liquid 
oxygen pumps on the H-l engine were extremely sensitive to NPSH and the gas 
generator was sensitive to ignition mixture ratio. It was necessary to control the 
liquid oxygen pump inlet temperature within a narrow band to satisfy both 
requirements. It was determined that the liquid oxygen temperature could be kept 
within the required start box by bubbling the liquid oxygen feedlines with helium for 
ten seconds prior to ignition signal. 
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Engine Compartment Heating (catast rophic, preflight) . The S-I/S-IB engine 
compartment contained components which were sensitive to the temperature 
range at which they operated. The primary temperature sensitive components 
were the SPGGs and the MFV actuators. It was necessary to control the 
temperature in the engine compartment to assure proper functioning of these 
components. An engine compartment heating system was developed and 
demonstrated to have the capability to maintain satisfactory temperatures for all 
critical components. 

Turbine Bearing Seizure (unworkable, flight! . The H-l engine turbopump gear 
box used RP-1 fuel for a bearing lubricant. To improve the lubricity of the RP-1, 
oronite was added to the fuel. During the test program, difficulty was experienced 
with turbine bearing seizure during post test turbopump torque checks. It was 
determined that this problem was caused by coking of the oronite at the 
temperatures of the numbers 7 and 9 bearings. The oronite additive was 
eliminated from the numbers 7 and 9 bearing lubricant which solved the problem. 

Engine Compartment Heat Shield (workable, mod, expected, flight) . A 
requirement existed to protect the components mounted in the engine compartment 
from the heat generated by the eight clustered H-l engines. During the test 
program, experimentation with various coatings established the optimum coating 
material to be used on the heat shield. 

Liquid Oxygen Vent and Relief Valve Position Indicators (unworkable. 
preflight). A problem with the stage liquid oxygen vent and relief valve position 
indicator micro-switches failing to indicate the valve position properly was found to 
be caused by the cryogenic conditions the valve was being subjected to during 
static tests. The valve had been qualified at ambient conditions. The valve was re- 
qualified under cryogenic conditions and no more problems were experienced. 

Liquid Qxvaen Tank Ullage Collapse (unworkable, flight) . During static firing, 
the stage liquid oxygen tanks were prepressurized with either gaseous nitrogen or 
helium. On the early tests, ullage pressure collapse was experienced during 
prepressurization. The initial design of the liquid oxygen pressurizing system did 
not include a gas diffuser at the inlet to the tank. A redesign was made which 
incorporated a diffuser and subsequent performance of the pressurizing system 
was satisfactory. 

Damage to Liquid Oxygen Tank Standpipes (unworkable, flight) . The S-I/S-IB 
stage configuration used four 70-inch diameter liquid oxygen tanks clustered in a 
circle around a central 105-inch diameter liquid oxygen tank. During propulsion 
system operation, liquid oxygen was transferred from the central tank to the 
outboard tanks through a standpipe located in each tank. The original design of 
the standpipes had them open on the discharge end. A sudden liquid oxygen tank 
ullage pressure decrease occurred mid-way into a firing. Pump NPSP 
requirements were violated and aluminum standpipes failed structurally. The 
cause of the ullage pressure change was spraying liquid oxygen from the 
standpipes into ullage gas and subsequent pressurant condensation. A redesign 
incorporated covers for the standpipes and resolved the issue. 
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namanp tn Engine Compa r tment Heat Shield Flexible Curtains (unworha t^ 
flights The design of the engine compartment heat shield included a flexible 
curtain fitted around the four outboard H-l engines which were designed to gimbal 
for thrust vector control. Several failures occurred during static tests, indicating a 
weakness in the design of the flexible curtains. A redesign of the curtains followed 
by extensive development testing precluded further failures. 

Thrust Structure Weakness (catas trophic, flight). The first TVC gimbal test 
performed on the S-l static test vehicle uncovered matching frequencies between 
the stage thrust structure and the gimballed engines. This forced a redesign of the 
thrust structure to decouple the frequencies. 


H-l Fnnine Thrust Increase (improvem ent, flight). Dunng the course of the S- 
I/S-IB program, the H-l engine thrust was increased in increments from 165,000 
pounds to 205,000 pounds. Each thrust level was satisfactorily demonstrated to be 
feasible for H-l engine operation in the clustered configuration by the propulsion 
system test program. 

I inuiri Oxvnen Pump Seal Failure (ca tastrophic, fliohtl During test S A- 52, a 
liquid oxygen pump seal failure caused fire and explosion in engine position 8. 
The following is quoted from the failure analysis report: 


"Had this been a launch and the same progression of events occurred, the 
launch fire detection system would not have prevented launch. Such an 
instance would have most probably resulted in loss of this engine in flight. Loss 
of the stage and mission is debatable since prevalves are provided which could 
control damage provided the loss of this engine was mild enough so that 
damage was confined to only that engine. 

"It is also noteworthy that had this failure occurred in flight and progressed to the 
point of engine or stage loss, it would not have been possible with the present 
flight instrumentation to have isolated the cause of the gross failure, much less 
the specific source of failure." 


Following this failure, the S-IB liquid oxygen seal was replaced with a bellows 
type seal. No additional malfunctions were noted. 

Turbine Blada Failure (cat astrophic, flight). A potentially catastrophic turbine 
blade failure occurred during Test SA-40. Subsequent inspection determined that 
five H-l engines had turbine blades manufactured from incorrect matenal. Turbine 
wheels were replaced on all of these engines, and they were re-tested at the 
manufacturer's site. 
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APPENDIX 8 


SATURN I, S-IV MAIN PROPULSION SYSTEM 


S-IV (Figure 8-1) was the second stage of the Saturn I vehicle and was 
developed by Douglas Aircraft Company for NASA. Development began in April 

1960 with the initial flight on January 29, 1964, and the final flight, number 6, on 
July 30, 1965. Payload to orbit capability was approximately 34,000 pounds. All 
six flights were successful. This stage served as the basis for the larger, more 
powerful S-IVB stage of the Apollo program. Figures 8-2 through 8-5 provide 
insight relative to stage design and important stage systems. 

The stage was propelled by six Pratt and Whitney-developed RL 10-A-3 
engines which used liquid hydrogen and liquid oxygen as propellants. The six 
engines were configured in a circle and thrust vector control was accomplished by 
engine gimballing. Total vehicle thrust was 90,000 pounds, approximately 15,000 
pounds per engine. The engines were ignited after S-l booster stage burn 
completion, approximately two minutes after liftoff, and then burned for 
approximately eight minutes. The engines operated at a nominal mixture ratio of 
5:1 and were ignited only once, although they were capable of multi-starts. 

The vehicle diameter was 22 feet. Liquid hydrogen propellant was located 
forward in a cylindrical single tank — unlike the booster stage which used multi 
tanks for each propellant— while liquid oxygen was located aft in an elliptical 
shaped single tank. The two propellants were separated by a single bulkhead, 
commonly known as common bulkhead. The bulkhead was a complex structure 
that not only physically separated propellants, but also provided thermal insulation 
and a means for detecting the presence of either of the propellants within the 
bulkhead interior— a serious safety concern if detected. Heat inputs to the liquid 
hydrogen tank sidewalls and forward bulkhead were controlled by internal foam 
insulation with an impervious barrier separating liquid hydrogen and the insulation. 
Helium gas stored at high pressure in spheres located within the liquid hydrogen 
tank was available for liquid oxygen tank pressurization and other purposes. 

Propulsion system testing included both battleship and all system vehicles. 
Other test articles were available for structural, dynamics, and other test 
requirements. A total of 27 firings and total firing time of 5440 seconds were 
recorded for the Battleship configuration during the time interval of December 1 1 , 

1961 to January 26, 1963. No tests were accomplished on the all-systems 
configuration before its destruction on January 24, 1964. 

ri 1 0A-3 Rocket Engine (Figures 8-2 and 8-31 . Electrical signals controlled 
pressurized helium which was used to actuate valves for starting and stopping the 
engines. Ignition of the propellants was accomplished by an electrical ignition 
system. Each engine was equipped with a thrust control assembly that was a 
servo-operated, variable position valve which controlled engine thrust by 
regulating the amount of fuel bypassing the turbine, thereby controlling turbine 
speed and fuel pumping. Thrust chamber tubular construction permitted use of a 
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FIGURE 8-2. RL10A-3 COMPONENT LOCATIONS 















regenerative operating cycle. Liquid hydrogen used to cool the engine during 
operation, was turned into a gaseous state and re-used to drive the fuel and 
oxidizer turbopump and supply pressurant to the liquid hydrogen tank. More detail 
on the engine follows. 


Major Components Thrust Chamber, Fuel and Oxidizer Turbopump Assembly, 

Oxygen Flow Control Valve, spark Ignition Subystem, 
Thrust Control Assembly, Miscellaneous Control Valves. 


Thrust Chamber Tubular-walled with chamber stiffeners; expansion area 

ratio, 40 to 1 ; chamber pressure, 300 psia; liquid oxygen 
to liquid hydrogen mass burn ratio, 5:1. 


Turbopump Assembly Located outside thrust chamber at nozzle throat; turbine 

driven fuel and oxidizer pumps; turbine power supplied 
from expanding fuel. 

Thrust Control Assembly Mounted on turbopump assembly; controlled thrust 

chamber pressure by regulating turbine speed; servo 
supply pressure, 672 psi. 


Oxidizer Flow Control Valve Mounted on turbopump near nozzle throat of thrust 

chamber; controlled oxidizer-to-fuel mass ratio for proper 
ignition, and consumption of oxidizer to minimize 
propellant residual at burnout; mechanical stops limited 
variance. 


Spark ignition Subsystem Consisted of oxidizer supply valve and ignition system, 

system used hydrogen from cool down tubes for fuel; 
oxidizer valve regulated oxygen supply to combustion 
chamber. 


Stanfl Oxidiyar System (Figure 8-4L Liquid oxygen was supplied to each 
engine by individual feedlines connecting each engine to a common sump located 
on the liquid oxygen tank bottom. A screen/vane assembly located at the tank 
outlet prevented liquid oxygen vortexing and provided filtration. Prior to launch, 
cold helium gas was injected into feedlines to cool the oxygen sufficiently to satisfy 
engine start requirements. Engine hardware cooling was accomplished during first 
stage powered flight by a regulated flow of liquid oxygen through the engine and 
exiting the nozzle. Part of this dumped flow was liquid which could solidify during 
the expansion to low pressures experienced at altitude. This was an unsafe event, 
thus a specially designed system using nitrogen prevented oxygen from solidifying. 

Gaseous helium pressurized the liquid oxygen tank ullage immediately prior 
to launch. Cold helium gas from storage spheres within the hydrogen tank was 
heated in a small hydrogen/oxygen burner, called a helium heater, and used to 
pressurize the oxygen tank ullage immediately prior to and during S-IV powered 
flight phases. Tank located pressure-sensing switches provide the control for all 
phases of oxygen tank pressurization — both preflight and flight. 
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FI CURE 8-4. S-IV OXIDIZER SYSTEM FUNCTIONAL 

SCHEMATIC 



A vent system provided for relief of pressure during fill and mainstage 
operation. The oxygen tank vent system was a combination vent and relief system. 
Two valves vented overboard all products of vaporization resulting from ground 
filling, and automatically relieved excessive pressure buildup within the tank during 
other operational phases. The vent valves operated independent of the tank 
pressure-sensing switches. 

Stanfl Fuel System (Figure 8-5) . Liquid hydrogen was supplied to each 
engine by individual feedlines from the liquid hydrogen tank. Each of the feedlines, 
total of six, was located external to the vehicle along the length of the liquid oxygen 
tank and penetrated the aft interstage assembly before connecting with the 
respective engine. Each feedline had appropriate flex and gimbal joints for 
maintaining structural integrity. Each feedline used vacuum jacket hardware for 
controlling heat input and anti-vortex devices and screens at the feedline tank 
interface. Hydrogen flow, necessary to cool engine hardware during first stage 
powered flight, was collected from each engine and dumped into three large lines 
attached to the outer vehicle skin. The lines ran the length of the vehicle and 
terminated outside the vehicle boundary layer in free stream flow near the vehicle 
base. This was necessary to prevent hydrogen gas entrainment and burning 
adjacent to the vehicle exterior. 

Gaseous helium was used to pressurize the liquid hydrogen tank ullage 
during terminal count immediately prior to launch and immediately prior to stage 
engine start, approximately three minutes later. Hydrogen gas bled from the six 
engines pressurized the tank ullage during the engine operational phase. Tank 
located pressure-sensing switches provided the control function for all phases of 
liquid hydrogen tank pressurization— both preflight and flight. 

A vent system provided for relief of ullage pressure during fill and mainstage 
operation and had similar operational characteristics as described for the oxygen 
tank. 


Note: Reference documents on S-IV stage were unavailable, thus the above 
description and section on accomplishments presented later are reconstructed 
from memory. 

S-IV ACCOMPLISHMENTS 

Accomplishments are from the memory of personnel involved in the program 
and are thus incomplete. Reference documentation was not available. 

Hydrngen Tank Insulation Cracki ng (unworkable. orefliahtL The liquid 
hydrogen tank of S-IV stage used internal insulation for controlling heat input to the 
propellant and to control frost/ice formation on the tank wall external surface. The 
insulating material for S-IV battleship was balsa wood. The all systems vehicle 
used the planned flight vehicle insulation — light weight foam blocks bonded to the 
internal wall and tank upper bulkhead. A light weight fiber glass cloth bonded to 
the insulation inner surface and coated with a sealant, epoxy was used to prevent 
insulation contamination with hydrogen. The initial propellant loading test of the all 
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FIGURE 8-5. S-IV FUEL SYSTEM FUNCTIONAL 
SCHEMATIC 





systems vehicle resulted in significant tank deflections and extensive insulation 
cracking. Testing was halted and extensive field repairs were made. 

HvHmnftn/Qxvoen Common Bulkhead l aakino (catastrophic. preflight/flighU- 
The all systems vehicle on the next test — another propellant loading test six weeks 
i ater _experienced an hydrogen leak in the common bulkhead— a potentially 
serious safety problem because of the close proximity of the oxygen tank. The 
vehicle was removed from the test stand for inspection and repair. 


Fnpine Oxvaen and Hvdroaen Propellant Chill Di sposal (unworkable, flight). 
The RL10 hydrogen/oxygen engine required hardware cool-down prior to engine 
start. The requirement was satisfied by controlled dumping of propellants through 
the engine during significant parts of first stage operation. Hydrogen gas disposal 
was through three large ducts attached to the vehicle skin which ran the length of 
the vehicle and then outward — dumping hydrogen in a free stream flow outside the 
vehicle boundary layer. Oxygen was dumped through the engine nozzle into the 
S-I/S-IV inter stage. Exiting liquid oxygen, present during some phases of the 
dump, expanded to near inter stage pressure and solidified. This was deemed to 
be hazardous, thus a system to prevent oxygen solidification was necessary and 
was developed. The system using large quantities of nitrogen within the inter tank 
was developed as a subsystem, verified in vacuum operation and 
integrated/verified in propulsion system testing. 

All System Vehicle Destruction ( catastrophic preflioht/fliahtt. The oxygen tank 
of the all system vehicle was overpressurized during the first attempted static firing 
An explosion resulted and the vehicle was a total loss. The test stand and ground 
support equipment were badly damaged. 

Halii im Heater Development Issu es (unworkable. fliahtL A combustion device 
using gaseous oxygen and hydrogen propellants named helium heater was 
developed and used to heat cold He gas for flight pressurization of the oxygen 
tank. Serious subsystem problems were encountered in development of the 
helium heater. Hardware was unavailable for propulsion system testing when 
initially required and when used was unreliable. System data was needed to venfy 
the total quantity of helium required, the required operational He flow rate range for 
the helium heater, establish compatibility of operation of tank pressurization control 
module and helium heater, etc. 


Prnnulfiion Hardware Failures (unw orkable. Drefliaht/fllQht), Vacuum jacketed 
feedlines, feedline expansion and gimbal devices, pressurization system flow 
control modules and tank pressure sensing devices, tank ullage pressure vent and 
relief valves all experienced frequent failures during propulsion system testing and 
required servicing and/or changeout. Failures resulted in test cancellation and 
delayed testing. Many of the problems experienced resulted from incomplete 
hardware development as components at the time required for system testing. 
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APPENDIX 9 


TITAN PROGRAM 


The Titan program had its inception in the middle 1950’s with the 
development of the Titan I ICBM which, while operational, had the greatest range 
and payload in the U. S. Missile Arsenal. Titan I was almost immediately 
redesigned to the Titan II configuration which differed from its predecessor in two 
very advantageous respects; (1) it used storable propellants; and (2) it was 
launched directly from the silo. Titan II also had increased thrust and propellant 
weight giving it increased range and payload over Titan I. The booster for the Titan 
II ICBM served, in an essentially unchanged configuration, as the launch vehicle for 
Gemini spacecraft and as the liquid propellant core (Stages I and II) for Titan III. In 
this way, all the extensive vehicle testing and manufacturing experience was 
directly applicable to space'operations. Testing activities were limited to only those 
things that changed. Minor changes for improvement in manufacturing or 
operations were easily evaluated. "Certified by similarity" became an accepted 
technique. Figures 9-1 and 9-2 illustrate the propulsion system for stages 1 and 2, 
respectively, while Figures 9-3 and 9-4 illustrate the Stage 1 engine and the Stage 
1 POGO control system. 

The reliability of Titan derives from the experience gained in the design, 
fabrication, test, and flight of the entire Titan family (see Figure 9-5). Over 400 Titan 
vehicles have been built. This number spans the Titan I, Titan II, Gemini, and Titan 
IIIA, Titan 1MB. Titan IIIC, and Titan HID configurations. Reliability of the Titan III 
members of the family was enhanced through the common core concept wherein 
Stages I and II of all Titan III vehicles are essentially identical. The core for all 
configurations uses common parts, common drawings, and common manufactunng 
and testing processes. Modifications to meet specific mission requirements were 
made with discrete kits that did not degrade the reliability integrity of the basic core. 
Table 9-1 lists notable firsts. 


Table 9-1. WAN III NOTABLE FIRSTS 



Mission 

Launch Site 

Date 


First Titan lll-C Flight 

Cape Canaveral 

06/18/65 


Unmanned Qaminl Capsule 

Cape Canaveral 

11/03/66 


Improved TVC 

Cape Canaveral 

05/05/71 


First Titan lll-D Flight 

Vandenberg Air Force Base 

06/05/71 

25 

Silver Anniversary Flight 

Vandenberg Air Force Base 

07/13/73 

28 

First Titan lll-E Flight 

Cape Canaveral 

02/11/74 

32 

First Helios Right 

Cape Canaveral 

12/10/74 

35 

Viking II Mars 

Cape Canaveral 

08/20/75 

36 

Viking 1 Mars 

Cape Canaveral 

09/09/75 

39 

Second Helios Flight 

Cape Canaveral 

01/15/76 

47 

Voyager 2 

Cape Canaveral 

08/20/77 

48 

Voyager 1 (final Titan lll-E flight) 

Cape Canaveral 

09/05/77 
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TITAN ICBM 


No information could be found for this study which directly concerned the Titan 
I verification process. 

A single declassified technical operating report titled, Titan II Missile N-1 Flight 
Test Report, dated September 1962, provided a glimpse of the Titan II verification 
process. Pertinent excerpts are reprinted here. 

"YLR87-AJ-5 Engine Performance. The steady state engine 
performance for each subassembly, represented by Pc, was 
approximately 6 percent low compared to the Pc predicted for the 
engine at propellant inlet condition for the flight. The cause of the low 
performance of approximately 6 percent on both engine subassemblies 
has not been absolutely determined to date. A possible explanation of 
the low performance would be the presence of approximately 3 to 4 
percent water in the fuel propellant. This percentage of water- 
contaminated fuel propellant could cause a 5 to 6 percent drop in 
performance as demonstrated by research and development tests 
conducted at Aerojet-General Corporation. Similar low performance of 
the YLR87-AJ-5 engine was evidenced on the flight readiness firings 
which fired for 13.4 sec. At that time, both subassemblies closely 
indicated the same percentage of low performance. This was attributed 
to faulty data.” 

"YLR91-AJ-5 Engine Performance. The engine operated at 
approximately 50 percent of the predicted level of performance. This 
caused the missile to fall short of its intended range. The low 
performance was attributed to leakage or blockage of the oxidizer flow 
to the gas generator. The abnormality became evident during the start 
transient and continued throughout the duration of engine operation. 

"It would not be possible to distinguish between leakage or blockage 
downstream of the oxidizer venturi with the instrumentation available. 

"The most probable cause of the failure is blockage of the gas 
generator oxidizer flow within the gas generator manifold by 
contaminants. These contaminants may have been introduced when 
the gas generator was retrofitted with an improved seal between the 
oxidizer check valve and the oxidizer inlet port. This retrofit was 
incorporated in accordance with Engineering Change Proposal No. 

6016 after the gas generator was acceptance-tested." 

GEMINI TITAN 

The Gemini Program Launch Systems Final Report. Aerospace Report No. 
TOR-1 001 (21 26-80)-3, dated January 1967, provides insight for this early manned 
verification process. At the beginning of the Gemini program, the Titan II ballistic 
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FIGURE 9-1. STAGE I PROPULSION SYSTEM 
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FIGURE 9-3. ENGINE STAGE I 
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FIGURE 9-4. "POGO" SUPPRESSION EQUIPMENT 






missile was chosen as the launch vehicle to be used in conjunction with the Gemini 
spacecraft. The decision was made at that time to use the Titan II "as is" with only 
those modifications required to enable the Titan II to perform the launch vehicle 
function for a manned system. 

The Gemini Launch Vehicle (GLV) engine configuration (-7 model) used the 
basic Titan II (-5 model) as a building block. Certain changes were made in the 
basic Titan II engine to adapt it to the critical uses of the Gemini program. The 
changes were prompted by the need to man-rate the Titan II, and/or by experience 
gained in the early Gemini flights. 

The propulsion system of the GLV was a direct adaptation of the Titan II 
propulsion system. Some deviations or additions were made to meet specific 
Gemini requirements. The launch vehicle used the Aerojet-General YLR 87-AJ-7 
liquid propellant rocket engine for Stage I and YLR 91-AJ-7 liquid propellant rocket 
engine for Stage II, respectively. These engines burned storable hypergolic 
propellants, nitrogen tetroxide and UDMH-hydrazine blend. The propulsion 
systems included a propellant feed system and a tank pressurization system. The 
propellant feed systems for first and second stages contained the tanks, feedlines 
and associated valving necessary to store propellants in the vehicle and supply 
these propellants to the rocket engines. The first stage propellant system also 
contained hydraulic oscillation suppression devices necessary to eliminate 
longitudinal oscillation instabilities (POGO) caused by closed loop coupling 
between the structural resonances and the propulsion system. The tank 
pressurization system was used to provide proper propellant pressure to the 
engines during start and flight. 

DEVELOPMENT HISTORY - GEMINI - 

The Gemini development of the propulsion system was conducted in the 
propulsion system test program (PSTP) at Aerojet-General, Sacramento, January 
28, 1 963 to March 2, 1 964. The purpose of the test program was to check and 
verify the operation of that portion of the Titan ll/Gemini propulsion system peculiar 
to the GLV. 

The PSTP results demonstrated the ability of the Gemini propulsion system to 
meet its design requirements. Tests were run to determine whether reduced fuel 
and oxidizer tank ullage volumes had adverse effects on engine starting 
characteristics. Results demonstrated that reduced ullages did not cause violation 
of engine net positive suction head requirements. Validity of the analytical 
technique to predict pressurization system performance was also satisfactorily 
demonstrated. The effects and calibration of engine performance with cold 
propellants were also demonstrated in these tests. 

Because of the performance requirements imposed on the launch vehicle, 
level sensor performance and reliability became significant factors. The flight test 
failures on Titan II and the problems encountered in attempting to qualify the 
sensors resulted in a decision to change from the Titan II level sensor to a Bendix 
unit for Gemini. 
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"Piggy back testing" was used to fly GLV hardware on Titan II R&D vehicles. 
Nineteen Bendix level sensors were flown on Titan II Flights N32 and N33. Flight 
uncovering times were compared with readings from the Titan II level sensors in 
equivalent tank locations. The agreement between all pairs of sensors was within 
tolerance. On these flights, the first indications of fuel sensor uncovery and 
subsequent recovery were noticed. This condition was verified on GT-1, and 
subsequent corrective action shielded the fuel sensors from pressurization gas 
condensation. 

The first Titan II flights showed a very high "g" level of oscillation in the first 
longitudinal mode in the time period preceding booster engine cutoff. The ”g" 
levels were too high for the equipment aboard the Titan II, much less a pilot. Titan II 
pursued the problem and found that an adequate reduction in level for a weapons 
system could be achieved by simply increasing fuel tank flight pressures. The 
reduced levels of oscillation resulting from this change were not, however, 
compatible with a manned requirement. A special program was established to 
evolve a fix that would reduce the levels to the +.25 requirement for a manned 
vehicle. The proposed fixes of detuning the feed system, the standpipe and fuel 
accumulator, plus providing an attenuation of pressure oscillation frequencies in 
the structural band, were tested and demonstrated successfully in three Titan II 
flights, N-25, N-29, and N-31. These flights verified the major portion of the initial 
Gemini redesign of the Titan II experimental hardware. The N-31 flight (flown with 
reduced fuel tank pressure) also verified that the hardware was effective at a 
reduced fuel tank pressure level, which was shown to be a strong parameter in 
controlling the levels of oscillation without the fixes. 

Considerable effort was directed toward the development of a remote 
charging system (AGE) which was used to tune the launch vehicle oxidizer 
standpipes. The system was developed to provide greater flexibility in mission 
planning. The original manual charging technique Involved opening prevalves 
and dropping propellant relatively early in the countdown, thus exposing the 
engine to oxidizer. This exposure necessitated a greater recycle time in the event 
of a launch scrub. The concept of the remote charging system provided increased 
safety in the charging operation and greater flexibility when the charging operation 
was performed because it was controlled from the blockhouse. It was proven 
through development test and subsequent flight test experience that the remote 
charge system provided a more consistent charge than the manual system. 

QUALIFICATION HISTORY - GEMINI 

Components in the GLV, like Titan items, were qualified by similarity to their 
respective Titan II counterpart. Qualification problem areas existed such as the 
POGO fuel accumulator position potentiometer, the tank topping system vent 
disconnect, the tank topping system solenoid valve, POGO airborne ball valve 
(shutoff valve) and the propellant tank level sensor. 

The basic POGO hardware, oxidizer standpipe and fuel accumulator, were 
qualified by successful flight test on Titan II Flights N-25, 29, and 31. During 
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component vibration testing of the POGO fuel accumulator rotary potentiometer, the 
potentiometer mounting screws loosened and the negator spring which connects 
the potentiometer to the accumulator piston slipped off the rim of its potentiometer 
attach wheel. Corrective action was taken to strengthen the potentiometer 
mounting provisions and these failure modes were eliminated. The potentiometer 
failed the propellant compatibility test due to penetration of oxidizer through the 
front bearing of the pot. Corrective action consisted of installing an O-ring seal 
external to the bearing area. 

Problems were encountered with the remote operated airborne ball valve in 
that the ball rotated to a slightly open position under vibration environment. The 
problem was solved by incorporating a spring detent mechanism to positively lock 
the ball in the fully closed position. 

Excessive connecting load problems were encountered with the tank topping 
system disconnect during qualification temperature testing. Corrective action 
included additional lubrication and tightening of valve and seal cleaning 
requirements. Sand and dust tests resulted in entry of contamination into the 
disconnect valve. Corrective action added seals to the open areas. 

The tank topping system solenoid valve failed to pass qualification vibration 
tests by exhibiting sporadic leakage. Corrective action consisted of changing the 
valve design from a normally closed to a normally open valve. 

The Bendix level sensors were subjected to a complete qualification test 
program. No significant problems were encountered with the component during 
this program. 

Using the Titan I and Titan II environmental criteria as a base, qualification 
tests were conducted on components which were new, which underwent a change 
in design or usage, or which experienced a more severe GLV environment. The 
test program required rigid controls and precise documentation. All failures were 
recorded, and Quality Control assured compliance to approved specifications, so 
that qualification testing became a formal program. 

CONCLUSIONS - GEMINI 

The lessons learned from the Gemini qualification test program were many 
and should be invaluable to a new program. Two significant areas are described 
below: 

1. It is important to separate the evaluation/development testing from formal 
qualification testing. The evaluation tests should start with prototype hardware, 
as soon as the level of the critical environments are established. 

2. Failures are an integral part of the test program, but no qualification test 
schedule has ever been permitted a "failure pad," because this would be 
admitting that an inadequate evaluation test program had been conducted, or 
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the design group had serious doubts as to the integrity of the components being 
tested. 

No flight failures were recorded on GLV hardware throughout the program, but 
one significant failure occurred after engine ignition that caused a shutdown on the 
pad. This failure (a tandem actuator) probably could have been prevented by a 
better design review or a better, more extensive qualification program. 

SPACE TITAN 

The Titan III story began in September 1961 with the initiation of the program 
definition phase for a standardized space launch system. The original concept for 
Titan III identified a standard launch vehicle that would be capable of delivering 
multiple payloads of various sizes and shapes into precise orbits or space 
trajectories. The requirements were also levied for operational simplicity and a 
reliable launch-on-time capability. This concept stimulated demanding, 
technological achievements. Problems and flight failures were encountered. Most 
important, it provided experience and knowledge which contributed to a successful 
operational manned launch system. 

The Titan III family of launch vehicles currently includes Titan IIIB, IIIC, and HID. 
The Titan IIIB configuration launched from Vandenberg AFB for classified military 
missions is composed of the Titan III common core and the Agena upper stage. 
Titan IIIC consists of the common core with two 120-inch diameter, 5-segment, solid 
rocket motors (SRMs) for its liftoff stage and Transtage as its upper stage. Strap-on 
SRMs used as the initial stage of Titan III vehicles are referred to as Stage Zero in 
order to retain the Stage I and Stage II nomenclature for the common core. Titan 
HID is designed for classified military missions also. This configuration used two 5- 
segment, 120-inch diameter SRMs identical to those of Titan IIIC, in conjunction 
with the common core, but it has no upper stage. 

GEMINI LAUNCH VEHICLE PROPULSION SYSTEM 

The propulsion system of the GLV was a direct adaptation of the Titan II 
propulsion system. Some deviations or additions were made to meet specific 
Gemini requirements. The launch vehicle used the Aerojet-General YLR 87-AJ-7 
liquid propellant rocket engine for Stage I and the YLR 91-AJ-7 liquid propellant 
rocket engine for Stage II. These, engines burned storable hypergolic propellants, 
nitrogen tetroxide and UDMH-hydrazine blend. The propulsion systems included a 
propellant feed system and a tank pressurization system. The propellant feed 
systems for first and second stages contained the tanks, feedlines and associated 
valving necessary to store propellants in the vehicle and supply these propellants 
to the rocket engines. The first stage propellant system also contained hydraulic 
oscillation suppression devices necessary to eliminate longitudinal oscillation 
instabilities (POGO) caused by closed loop coupling between the structural 
resonances and the propulsion system. The tank pressurization system was used 
to provide proper propellant pressure to the engines during start and flight. 
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Component Configuration 


The propellant feed systems were designed to produce a minimum pressure 
loss at the design flow rates. The Stage I and Stage II propellants were stored in 
ten-foot diameter aluminum tanks which also formed the primary launch vehicle 
structure. Oxidizer was fed to the engine turbopump inlets by an aluminum 
feedline, passing through a conduit in the fuel tank. For Stage I, the oxidizer 
feedline was divided in the engine compartment to feed each engine subassembly. 
The fuel tank outlets were located immediately above the engine pump inlets. 

The propellant tanks had anti-vortex and anti-slosh baffles. In addition, the 
oxidizer tank outlets were designed to prevent loss of energy in discharging the 
propellant from the tanks. 

Propellant prevalves were used in the propellant feed system. The prevalves 
held propellants above the engine pumps and thrust chamber valves until opening 
was necessary for terminal countdown. The launch vehicle was filled and drained 
of propellants through manual disconnects located upstream of the prevalves. 

Liquid level sensors were installed in the fuel and oxidizer tanks to facilitate 
propellant flow rate and outage measurement for performance calculation. 

Propellant temperature probes were provided in all propellant tanks to ensure 
that propellant temperature at liftoff did not exceed the allowable limits based on 
vehicle performance margins for each mission. 

A propellant fill-and-drain system was used to transfer propellants from the 
AGE to the vehicle tanks. The ground system included transfer pumps, and 
instrumentation to assure that propellants were transferred to the vehicle at proper 
temperatures and in the proper quantities. 

From the initial lock-up condition prior to launch until engine shutdown at 
burnout, the pressurization system was designed to provide adequate propellant 
tank ullage pressure to satisfy (a) minimum NPSH requirements for the engine 
driven propellant pumps and (b) minimum launch and inflight structural 
requirements of the tanks. Simultaneously, the pressurization system was not 
supposed to exceed pressures as defined by structural limitations. 

Initial pressurization of all propellant tanks was achieved with a charge of 
nitrogen gas regulated to a predetermined level. In flight, tank pressurization was 
provided to both fuel tanks by using cooled rocket engine turbine exhaust gases. 
The Stage I oxidizer tank was pressurized by vaporized oxidizer from the engine. 
The Stage II oxidizer tank was pressurized in flight by the initial nitrogen lockup 
pressure and supplemented by vaporization of the tanked oxidizer. Burst discs 
were installed in each tank pressurization line. 

The inflight pressurization subsystem for Gemini was essentially the same as 
that used in Titan II. Exceptions were as follows: (a) The pressurant flow to the 
Stage I fuel tank was increased by a change in the engine flow control orifice size, 
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and (b) Stage I oxidizer pressurant flow rate was increased through an orifice 
change and the tank "lockup" pressure was increased. 

A revised tank pressure control system known as the tank pressure topping 
system was designed for the GLV. This system incorporated a pressure supply and 
vent line which was in parallel with the main pressure supply line available to each 
tank. When the main lines were disconnected, pressure control was retained 
through the smaller pressure topping lines which remained connected until liftoff. 
Lanyard operated pull away couplings were used to separate the GLV from the 
AGE and effect a seal at the vehicle skin line. An airborne, solenoid-operated,, 
normally open valve was located upstream of the disconnect coupling on the GLV. 
This valve provided seal redundancy in flight and a method for leak testing during 
the prelaunch countdown. 

One of the big differences between Titan II and GLV in the propulsion system 
was the use of suppression devices to control the longitudinal oscillation that 
occurs during first stage flight. The POGO suppression devices consisted of tuned 
resonators inserted into the engine feedlines just upstream of the first stage pumps. 
These devices were tuned to provide attenuation of pressure oscillations in the 
frequency band of the structural first longitudinal mode. In the oxidizer lines the 
resonator was a standpipe, while in the fuel lines a tuned mechanical accumulator 
was used. 

The oxidizer standpipe worked on the principle of using an entrapped gas 
bubble to provide a soft spring for the oxidizer mass in the standpipe to act upon. 
The energy due to pressure oscillations could be transferred to this spring mass 
system at the desired frequency by proper choice of the volume of the entrapped 
gas bubble. The fuel surge chamber or accumulator used a helical spring and 
piston to perform the same job. The spring together with the piston and fuel mass 
in the accumulator acted to provide the desired resonance. 

GLV ENGINES 

Propulsion for the GLV system was provided by the Aerojet-General 
Corporation manufactured YLR87-AJ-7 Stage I and YLR91-AJ-7 Stage II engines. 
These engines were modified Titan II engines. 

The basic Gemini engine system and those major features which were unique 
to the Gemini system are described below. 



The YLR87-AJ-7 rocket engine assembly was a storable liquid bi-propellant, 
turbopump fed, dry-jacket-start engine rated for sea level operation. The engine 
was composed of two independently operating subassemblies which operated 
simultaneously, mounted on a single thrust structure. Each subassembly 
contained a thrust chamber assembly, turbopump assembly, gas generator 
assembly, starter cartridge, propellant plumbing, and electrical controls harness. In 
addition, subassembly two (S/A 2) provided the energy source for tank 
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pressurization. The major components of each subassembly were identical except 
for the pressurization system. 

The design concept of this engine system was to achieve reliability through 
simplicity. This goal was achieved by use of hypergolic storable propellants which 
eliminated the need for bleed down, heaters and ignition systems. The engine 
required no functions during countdown beyond admission of propellant to the 
engine from the tankage. Thrust level was preset by sized cavitating venturis which 
were located in the gas generator propellant feed circuits. Cavitating venturis 
controlled flow to the gas generator which controlled turbine power by hydraulic 
equilibrium, thereby eliminating all servo thrust control mechanisms. 

Descriptions of the major components follow. 

Thrust Chamber Assembly . The thrust chamber assembly consisted of a 
regeneratively fuel cooled tubular construction combustion chamber, injector, 
injector dome, fuel thrust chamber valve assembly, oxidizer thrust chamber valve 
assembly, gimbal assembly, thrust chamber pressure switch, and oxidizer and fuel 
propellant lines. The above components were packaged as an integral assembly. 

The thrust chamber fuel valve consisted of a four inch gate butterfly valve with 
attached hydraulic actuator. The actuator was spring loaded in the closed position. 
The actuator shaft was mechanically linked to the fuel valve shaft. The fuel valve 
shaft in turn had a clevis for linkage to the oxidizer thrust chamber valve. 

Control of the thrust chamber fuel valve actuator was achieved by use of a 
direct mounted pressure sequence valve (PSV). The PSV mechanically sensed 
fuel system supply pressure and opened at a level which allowed fuel pressure to 
overcome the spring force of the thrust chamber fuel valve actuator and open the 
fuel and oxidizer valve by mechanical linkage. Closure of the thrust chamber valve 
was achieved by an electrical solenoid which overrode the pressure sensing 
element. This caused the PSV to neutralize and admit fuel pressure. to the closing 
side of the thrust chamber actuator to assist spring closure of the thrust chamber 
valve. 

Gas Generator Assembly . Each gas generator system consisted of an integral 
gas generator chamber and injector, fuel check valve, oxidizer check valve, gas 
generator feed lines, cavitating venturis and propellant strainers. The gas 
generators were mounted directly to the inlet of the turbine pump assembly turbine 
drive manifold. 

Turbooump Assembly . The turbopump assembly consisted of a fuel pump 
subassembly, oxidizer pump subassembly, two-stage turbine drive assembly and a 
gearbox assembly. The gearbox contained an integral oil pump, reservoir filtration 
system and lube oil cooler. These components were integrated into an assembly 
on the basic gearbox structure. The Gemini gearbox incorporated gears of 931 0 
alloy and SKF bearings exclusively. 
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Solid Start Cartridge . The solid start cartridge was comprised of a steel 
combustion chamber which housed two concentric cylinders of ammonium nitrate 
propellant (AMR 2506). An ignition train assembly was mounted at the head end of 
the cartridge. Burning rate of the cartridge was controlled by a flow control nozzle, 
as well as by stringent maintenance of start cartridge temperature, through the use 
of cartridge thermocouples and temperature controlled air supplied to the external 
surfaces of the cartridge. A teflon burst diaphragm over the nozzle hermetically 
sealed the cartridge assembly. A pyrotechnic squib was installed in the cartridge 
and electrically fired to initiate the ignition train. 

Hinh Pressure Propellant Lines . The high pressure fuel and oxidizer lines 
consisted of bolted flanges, tubing, and three 2-axis articulated flex joints. The flex 
couplings were arranged to allow for assembly tolerances and to allow thrust 
chamber flight control flexure obviating the need of rotary seals to achieve thrust 
chamber motion. All thrust chamber gimbal motion was taken between the 
chamber assembly and turbopump assembly. The turbopump assemblies were 
stationary to the frame and did not move during gimbal operation. 

i nw Pressure Propellant Plumbing . The fuel and oxidizer lines connecting 
the turbopump to the tank outlets consisted of low pressure bellows assemblies, 
modified by POGO gear, from tank outlet to pump inlet. The bellows assemblies 
were for the purpose of absorbing relative deflections and to allow small 
misalignment of assemblies. 

Snhassemhlv Two fS/A-21 O xidizer Pressurization Super Heater Assembly . 
The super heater assembly was a cross flow tube-type heat exchanger located in 
the turbine exhaust in the subassembly two turbopump. Energy in the turbine drive 
exhaust gases was used to vaporize and disassociate liquid nitrogen tetroxide. 
The amount of pressurant gas was controlled by a cavitating venturi into the liquid 
side of the circuit. Energy in the gas was controlled by a back pressure nozzle in 
the gaseous side of the circuit. The oxidizer pressurant system included the 
associated plumbing. 

Suhassemblv Two (S/A-2 Fuel Tank Pressurant Heat Exchange- The gas 
cooler assembly consisted of a bundle of U-shaped tubes enclosed in a cylmdncal 
shell. Fuel was circulated on the interior side of the tubes as a heat exchange 
medium Hot gas passed through the external passages around the tubing to the 
fuel autogenous system. The hot gas flow rate was controlled by a sonic nozzle in 
the plumbing circuit. 

Sequence nf Operation . At a minimum of 30 seconds prior to engine start, 
propellant valves at the tank outlets were opened allowing propellant into the 
engines up to the thrust chamber valves (TCV's). The engines were self-bleeding 
by gravity head. 

Each Stage I subassembly start was initiated by providing a 28-vdc signal to a 
redundant bridge wire squib in the solid start cartridge initiator. The initiator fired 
the ignition train which started burning of the solid propellant grain. Energy from 
the solid propellant caused acceleration of the turbopump assembly. As the 
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turbopump assembly generated fuel pressure head, the pressure sequence valve 
shuttled at a pre-set pressure causing the thrust chamber fuel valve to be actuated 
open by fuel system pressure. The oxidizer valve was opened by mechanical 
linkage to the thrust chamber fuel valve. Propellant flow from the turbopump filled 
the volume in the thrust chamber assembly and ignition occurred upon contact of 
the propellants in the combustion chamber. As a result of thrust chamber 
combustion backpressure, propellant was supplied through gas generator feed 
lines downstream of the thrust chamber valve initiating the regenerative (bootstrap) 
cycle. As a result of the initiation of bootstrapping, the engine achieved rated 
thrust. Energy of the start cartridge was controlled to burn out immediately after the 
start of the bootstrap operation as the engine approached steady state operation. 
The thrust level was controlled by tuning pre-sized cavitating venturis to achieve 
hydraulic equilibrium. No electrical power whatever was required by the engine 
during steady state operation. 

During these initial moments of life of the engine, two Pilot Safety systems 
were monitored for engine parameters/characteristics in order to detect any 
abnormal operation. The first was known as the Prelaunch Malfunction Detection 
System and was operative until the vehicle was airborne. The second, known as 
the Malfunction Detection System, continued operation and surveillance 
throughout Stage I flight. 

The PMDS was designed to monitor the Stage I autogenous system operation 
prior to release of the launch vehicle and to furnish go/no-go signals to launch 
control equipment in response to the conditions sensed in the fuel and oxidizer 
autogenous systems. 

The MDS was a warning system that provided a visual cue to the astronauts in 
the spacecraft in the event of a launch vehicle subsystem malfunction which could 
possibly result in the failure of the flight mission. The Malfunction Detection Thrust 
Chamber Pressure Switch (MDTCPS), a part of the MDS package, also provided a 
signal to launch control equipment verifying attainment of proper thrust prior to 
vehicle release, as well as serving to initiate the controlled shutdown sequence 
whenever a pre-determined decay in thrust chamber pressure had occurred. 

Engine shutdown was accomplished by either oxidizer exhaustion or fuel 
depletion. Although neither type of shutdown caused problems on the Gemini 
engines, the oxidizer exhausting was more desirable from a hardware integrity 
standpoint and shall be used to further describe the shutdown sequence. As 
oxidizer was depleted, the MDTCPS sensed a decay in thrust chamber pressure; 
the switch opened, causing a 28 vdc signal to be sent to the override solenoid of 
the PSV. The PSV override shuttled the PSV, causing fuel system pressure to be 
vented from the opening side and applied to the closing side of the actuator. As the 
thrust chamber valves closed, the propellant supply to the gas generator was 
terminated with a resulting thrust decay of each subassembly. 

Major Changes . As previously noted, the GLV engine configuration (-7 
model) used the basic Titan II (-5 model) as a building block. Certain changes 
were made in the basic Titan II engine to adapt it to the critical uses of the Gemini 
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Program. The changes were prompted by the need to man-rate the Titan II, and/or 
by experience gained in the early Gemini flights. Although many changes were 
incorporated during the Gemini Program, certain major changes warrant sufficient 
attention to be singled out for special mention. 


Stage I Gearbox . Failure of the idler gear which resulted in catastrophic 
failure of the turbopump was encountered. Strengthened gears were incorporated 
on all Stage I gearboxes for GLV-2 through 12. A second failure, which required 
resolution prior to manned flight, centered around failure of the number 6 bearing. 
Gemini's solution prescribed use of SKF bearings only and redesign of the turbine 
interchange labyrinth seal. 


stana l Fnflina Frame . The Stage I engine frame was qualified by similarity to 
the Titan II engine frame. However, because of certain, though minimal, 
modifications the capability of the Gemini engine frame under the conditions of 
firing and gimballing was verified during the propulsion system test program. 


Fiaxihla Lnha Oil Cooler Coo lant Lines. The fuel return line (from the oil 
cooler) fractured approximately 30 seconds after the start of a hot-fire test on 
Gemini engine GLV-1011. The failure was attributed to excessive loads due to 
vibration and assembly distortion. A change to flexible inlet and outlet lines (for the 
fuel coolant) was incorporated to preclude further occurrences of this nature. 


start Partridges . Two problems were encountered which were resolved by 
incorporating non-interchangeable (between Stage I and Stage II) diaphragms and 
temperature conditioning of the cartridge itself. 


Propulsion System Test Program . This program was promoted to 
evaluate/demonstrate the satisfactory operation of Gemini unique components and 
requirements for the Stage I and Stage II propulsion systems. 


n-s Volt inst nimantation System. The Gemini program used a 5 volt full scale 
telemetry system, whereas Titan II had used a 40 mv. full scale telemetry system. 
The higher output voltages from remote transducers on the Gemini system 
improved the overall signal-to-noise ratio and reduced the complexity of the 
multiplex/encoder. 


T n.v Straps Corrosion. Failure of a thrust chamber fuel valve body prior to 
liftoff on one of the ^tan ll vehicles was attributed to stress corrosion. Investigation 
resulted in a change of heat treat from T-6 to T-73 on Gemini. 


Stage II Engine 


Qvctam Description . The Stage II engine system was in general identical in 
design concept to that of the Stage I engine system. The distinguishing features 
which differentiate the Stage II engine from the Stage I engine were the following. 


1. Stage II engine components were a reduced thrust version of Stage 
subassembly. 


9-17 



2. Rated for altitude start and operation with a baffled injector. 

3. The high expansion ratio chamber (49.2:1) was achieved by use of an ablative 
extension from 13:1 to 49.2:1. 

4. Turbine exhaust gases were ducted through a swiveled nozzle assembly to 
provide roll control during Stage II powered flight. 

5. Pressurization as required only on the fuel tank of the Stage II vehicle. Oxidizer 
tank pressurization was supplied by precharge and boiloff only. 

6. The Stage II cartridge incorporated the same design features as the Stage I 
except that the propellant was a single, longer cylindrical section. It also 
included a conditioning system similar to Stage I. 

7. Stage II had no thrust chamber pressure switch (TOPS). 

8. Stage II incorporated a redundant shutdown system (RESS) which is described 
later in this report. 

9. Stage II did not have a PMDS system and the MDS switch monitored fuel 
injection pressure (MDFJPS) not chamber pressure as on Stage I. The 
MDFJPS was not a part of the shutdown circuitry as the Stage I MDTCPS. 

System Operation. The Stage II engine sequence was identical to the Stage I 
engine subassembly. The same signal which shut down the first stage signaled 
the second stage ignition. Staging was accomplished by the "fire-in-the-hole" 
concept. Stage II thrust buildup caused separation of the vehicle stages. As will be 
noted further on, Gemini had a unique feature of redundant shutdown capability on 
the Stage II engine. This redundant shutdown capability was achieved by firing a 
squib actuated valve in the gas generator oxidizer feed circuit simultaneous with 
the signal to the thrust chamber valve. 

Major Changes . This section reports on major components or systems which 
were unique to the GLV Stage II engine compared to the Titan II Stage II engine. 
They were also unique to GLV Stage II compared to GLV Stage I unless otherwise 
noted. These systems were developed and incorporated due to Gemini program 
requirements or as the result of problem solutions. 

Redundant Engine Shut down System (RESSL A redundant engine shutdown 
capability was added to minimize the possibility of spacecraft overspeed due to a 
failure of the basic thrust chamber valve/pressure sequence valve. This redundant 
system was developed under the augmented engine improvement program and 
consisted of a squib actuated valve in the oxidizer bootstrap line which was 
activated by the same signal sent to the PSV. This system was incorporated on 
GLV-3 and subsequent vehicles. 

Fuel Injection Pressure Switch . The malfunction detection system pressure 
switch initially monitored chamber pressure as on the Stage I engine. However, 
the initial Titan III Stage II engine which used a similar configuration switch 
encountered combustion instabilities on two acceptance tests. The analysis 
indicated the most probable triggering mechanism was detonation in the sensing 
tube, and the magnitude a function of line volume. As GLV corrective action, the 
MDS switch was re-located to sense fuel injection pressure, which reduced 
sensing tube volume to a minimum with only a chamber pressure transducer on the 
combustion chamber. This action was taken because the standard Titan family 
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injector (which had a higher susceptibility to instabilities) was on the first seven 
GLVs. The relocation was effective on GLV-2. 

nFMSlP Injector . A dynamically stable injector was developed to increase the 
combustion stability margin. The new injector, GEMSIP, was incorporated on GLV- 
8 and subsequent vehicles. 

start Cartridge Temperature Conditioning . As previously described, a solid 
start cartridge conditioning system was also incorporated on t k - Stage II engine 
system. 

0-5 Volt Instrumentation System . The 5-volt flight instrumentation system was 
also incorporated on the Stage II engine system. 

The same configuration ablative skirt was utilized of the GLV engine but due 
to longer burn durations, a program was conducted to demonstrate the capability to 
withstand these durations. To ensure that the incorporation of the GEMSIP injector 
was also compatible with these long durations, additional testing was conducted. 
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APPENDIX 10 


STATIC FIRING SATURN STAGES 


This MSFC Test Division memorandum (report) is included both for historical 
data completeness and because it addresses a related issue. 

The only copy obtained was several reproduction generations old. To ensure 
readability, the liberty of re-typing the report and re-working the figures was taken. 

Some conclusions drawn by this report are applicable to the value of 
propulsion system testing. 
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STATIC FIRING SATURN STAGES 


INTRODUCTION 


The question has often arisen as to the justification for continuing static 
firing Saturn stages. The question has been asked by program management 
which seeks a "mathematical" answer. A "mathematical" answer would under- 
standably relieve management of having to make a decision based only on 
engineering judgement or tradition. The motive is understandable because of 
the real cost of the present day approach and the fear of a human failure 
which can lead to the destruction of equipment as it has in the S-IV and 
S-II. 

Any statement regarding static firing of flight stages must be prefaced with 
a statement as to why flight stages are static fired. Flight stages are 
static fired to determine the quality (design and hardware) of that particu- 
lar assembly at a time and place where a flight catastrophic type failure 
can be best withstood and controlled. To provide this benefit to the 
program, management must assume that the testing discipline and philosophy 
is such that it can provide efficient screening of defective design and 
hardware. To provide the most confidence, management must also assume that 
the article tested is as nearly as possible the same hardware as that which 
will subsequently fly. The opportunity to exercise this screening process 
is not a product of Inventive genius, but the simple recognition that people 
are fallible especially where the results of their errors are not immedi- 
ately apparent to them as In factory assembly. Management should also rec- 
ognize that static firing, as opposed to checkout, provides a more realistic 
test stress and the only real end-to-end check of many of the stage systems 
and real verification of their functional capability. The objective data 
gained from this testing Is a major, clear, forcing function in the develop- 
ment cycle not only of the hardware but of the people (designer and 
manufacturer). That neither of these appreciate this surveillance is 
humanly understandable, but should not be determining factor In its 
existence. Neither should management yield to their own discomfort when 
this objective event reveals problems which by hindsight are ridiculous, but 
whose discovery are the very reason for testing. 

Static firing Is a natural attribute of liquid propulsion systems (provided 
their design Is not too sophisticated) because the real flight hardware sys- 
tem can be meaningfully, functionally tested on the ground where the static 
fired, hardware is available for post-test visual inspection and where more 
detailed and more accurate measurement of performance parameters can be 
obtained that can In flight. 

In this day and age, the design of components of a flight system is rela- 
tively amenable to straight forward mathematical analysis where only that 
component's self contained operational environments are considered. It is 
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another matter when this component Is required to function properly in a 
system which produces a combination of environments which can only be 
determined by empirical means. Additionally, these system environments may 
change from assembly-to-assembly because no two assemblies are exactly the 
same even when made from the same drawing. Processing freedom (a necessity 
if you ever want to get a product) and material non-homogeneity account for 
some of the natural variances from assembly-to-assembly. Therefore, manage- 
ment must assume some variances in a system even though it be tightly con- 
trolled by paper. 

The obvious, underlying management assumption must be that the test opera- 
tions can be performed with a minimum chance of catastrophic loss of the 
test item by human error. Management should therefore allow every reaso- 
nable means to be taken to sense and prevent catastrophic loss of proper 
add-on instrumentation, fire systems, leak detectors, automatic safeing 
features, and hazards and damage control apparatus. Secondly, extensive 
instrumentation is available for static firing to be able to determine cause 
of failure in an objective manner. 

The mere existence of a stage static firing capability (facility and crew) 
provides a key resource to fall back upon for the solution of flight 
problems and the capability to verify major functional design changes. 

Some specific stage systems can only be functionally tested by static firing 
the stage, (such as active propellant utilization, propellant pressurlza- 
tloni, engine gimbal actuation under main hydraulic pump power and flight 
control systems). Conversely, there are some environmental conditions such 
as vacuum and aerodynamic loads and vibrations which are not economically 
feasible to simulate on the test stand. Additionally, a large proportion of 
the flight measuring system for vibration, pressures and temperatures gets 
Its only real end-to-end check through propellant loading and/or static 
fi ring. 

In payload critical missions. It Is very important to have real charac- 
teristic data for the specific flight hardware. Such characteristics as the 
specific propellant tank calibration, depletion efficiency, pressurization 
performance, and engine performance become most critical to furnish data for 
flight prediction, especially where no active propellant utilization system 
is used. Without this real data, statistically sound, and performance 
trade-off negotatlons become a matter of pure subjective judgement. 

Provided no major functional design changes occur and provided that system 
quality can be Infallibly controlled (both avowed developmental goals) then 
the gain In confidence provided by static firing should decrease with 
Increasing number of stages produced. It should be borne In mind, however, 
that there are some characteristics of the Saturn system that work contrary 
to these goals. Mission requirements have been and probably will be 
changeable. Many parts are Involved (as one contractor proudly claims more 
than 2 million per Saturn V vehicle) making control very difficult espe- 
cially when prime contractors do not exercise contractual control of a_n 
changes In their vendor's, fixed price procured, components. None the 
less, proof that not much more Is to be gained y continuing static firing 
should, for any reason, be objectively evident from the decreasing rate of 
occurrence of critical failures. Two sources of historical information were 
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evaluated to determine whether static firing had, in fact, provided an 
objective demonstration of hardware design verification, quality assurance 
and subsequent successful flight assurance. The static firing and flight 
histories of non-Saturn programs were evaluated because of the large samples 
provided and the different approaches involved. Secondly, the results of 
static firing and flying the Saturn flight stages were evaluated because 
they are directly applicable. 


2. BASIS FOR SELECTION OF REPORTED FAILURES ON NON-SATURN LAUNCH VEHCILES 

Data was provided by the contractors themselves and from a report prepared 
by an outside system contractor. Where in conflict the responsible contrac- 
tor's data was used. This data was then screened for failures in flight 
which were caused by systems that were judged to be static firing, testable, 
and therefore, ideally could have been prevented from happening in flight 
by a proper static firing test program. The depth of the data did not 
include what in addition was discovered and corrected in those static 
firings which were made nor what design changes and, disassemblies were 
made after static firing and prior to launch. The data provided for these 
systems can only be used to answer the gross question of whether a learning 
process did exist and whether static firing, where performed, appeared to 
allow an acceleration of this learning process. Additionally, the answer 
might be provided to the simple question of whether static firing, testable 
systems ever came to such a maturity that failures no longer occurred even 
when large numbers of flights were made. 

3. BASIS FOR SELECTION OF REPORTED DATA ON SATURN FLIGHT STAGES 


The critical failures reported herein were selected to the exclusion of 
other findings because they fitted the situation where they would not have 
been found by checkouts and therefore, would have occurred during the launch 
countdown or flight If they had not occurred during the first static firing 
countdown of that specific stage. These failures were classified into two 
categories: 

a. LAUNCH ABORTS AVOIDED 

These were S-l, S-1B and S-1C booster stage systems failures which 
occurred during the first attempt or accomplishment which would have 
caused an aborted launch If this operation was assumed to have occurred 
at the launch site rather than on the test stand. Within this category 
falls those failures which actually terminated the static firing between 
ignition and launch commit and those failures encountered which at the 
launch site during terminal countdown would have required detanking to 
fix. The case assumes a Wet Countdown Demonstration Test would have 
eliminated those problems found during propellant load tests and there- 
fore these were not included in this category. 

b. MISSION FAILURE AVOIDED 


Those booster and upper stage systems' failures encountered during the 
first static firing attempt or accomplishment which would have in most 
probability caused a major mission loss If this operation had really 
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been the flight instead of static firing. Second or subsequent failures 
were specifically excluded by this screening in order to keep the model 
mathematically pure. 

Saturn static firing experience provided another category of data which 
OTHER CRITICAL FINDINGS 


Those booster and upper stage systems failures which were experienced at 
any time in the propellant loading and static firing operations but 
excluding those listed under the first two categories. 

UNSATISFACTORY CONDITIONS 

(Defects, PARS, FARS, etc.), during the static firing and post-static 
operation were specifically excluded from this analysis. Some of these 
conditions were found simply because a new set of evaluators worked 
with the hardware In a more nearly real functional environment than can 
safely be provided by factory checkout. These experiences would have 
surely been passed on to the launch site and caused excessive delays 
there where the resources for their solution should intentionally be 
limited so that maximum attention can be focused on the business of 
launching. Others, however, were unecessarlly caused by this additional 
operation and traffic with the stage. The specific significance becomes 
a matter of strong subjective judgement and leads to an endless 
controversy. 

4. RESULTS 


The data from ten different systems was compiled and evaluated, (2 Army, 3 
NASA and 5 Air Force). All except the Gemini, static fired flight stages 
prior to launch (See TABLE 1). Here the similarity ends. 


Those which did employ static firing did not employ a uniform discipline, 
for Instance, short (less than 50% full) duration versus full duration. 


Even those which did employ full duration (l.e., Redstone and Jupiter) had 
less than the full stage system (TM and electrical control) on for static 
firing unlike the way the Saturn stages are static fired as complete stages. 
It was unofficially reported that occasionally. Titans were static fired 
with "slave" engines which were removed prior to shipment to the launch site 
where the flight engines were Installed. 


The number of stages which were static fired prior to flight varied from two 
(2) to fifty-seven (57) before static firing was stopped. In all cases 
except Titan III (Table 3), the first group of stages was static fired. 

The design complexity of the systems varied widely ranging from single stage 
to three stage (all liquid and combination of liquid and solid). The Titan 
III and the Saturn 1/ IB are not that uncommon If we consider that 1/IB has 
solid retro rockets and storable APS systems which must function reliably 
for mission success and which are not static fired prior to launch. 
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Not all programs were executed concurrently, therefore, the later ones had 
the opportunity to learn from the earlier. 

In the non-NASA programs there was a wide divergence in average yearly 
launch rate (TABLE 2), from nine (9) to thirty-one (31). 

The mission losses (TABLE 2) because of systems testable by static firing 
was, in all cases, far less than those from all causes, comprising only from 
10 to 33%. Of those which did fail because of systems testable by static 
firing, failures occurred on flight stages which had been static fired prior 
to launch as well as on flight stages which had not been static fired prior 
to launch. 

Because some learning curve should result, either from static firing and 
launch or from just launching, a plot was made assuming all selective data 
points to have the same weight, but still take into account only those 
mission loss, failures experienced in systems testable by firing. This data 
is shown plotted in FIGURE 1. There was obvious learning, on this specific 
basis, in all cases except Atlas. The pay-off did not become apparent on 
the average until after 25 to 30 launches. However, even after that, 
failures did persists, but at a much lower frequency. 

In the comparison of the fourteen (14) Gemini flights, which was the only 
system with a complete absence of any kind of static firing, with the first 
fourteen (14) flights of those systems which had some kind of a static 
firing program, it can be seen from TABLES 2 and 3 that the SATURN 1/IB, 
Titan II and Titan III experienced none of these specific type failures, 
while the Gemini experienced two (2). However, the Redstone, Jupiter, Thor, 
Atlas and Titan I did experience anywhere from one (1) to six (6). It 

should also be noted however, that the Gemini should have drawn heavily on 
the learning paid for In the preceding flights and tests of the Titan II. 

In analyzing the Saturn stage, data contained In TABLES 4 through 8, it can 
be seen that critical failures were still being experienced from static 
firing of the S-1B stage even on the eighteenth (18) stage to be static 
fired. 

Learning has been more rapidly achieved on those stages than was apparent 
from the non-NASA programs. Flight results of Saturn bear out this obser- 
vation. 

The same randomness of occurrence versus sequential order as observed In 
non-NASA flight results, appears in the Saturn static firing experiences but 
does not appear in the flight experience. 


5. CONCLUSIONS 


There is no evidence from these statistics which would give an unqualified 
answer as to the serial number at which static firing can be stopped with 
the positive assurance that no failures can occur which could have been 
avoided by a properly performed static firing. 
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The tenacity with which failures persist suggests that even under our most 
extensive (and expensive) work control system learning is limited by other 
factors. J 


There i 
a major 
listed 
overal 1 

instead 
that of 


no doubt that static firing of Saturn stages to-date has provided 
contribution to Its successful flight history. If the failures 
n TABLE 7 had occurred in flight rather than in static firing, the 
flight performance of Saturn 1/IB would have been 66% successful 

of 100%, and would have had a worse development characteristic than 
the non-NASA programs as can be seen from FIGURE 1. 
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Table 1 

FLIGHT VEHICLE LAUNCH AND STATIC FIRING PROGRAM 

BASIS: AVAILABLE DATA 


PROGRAM 

LAUNCH PERIOD 

NO. FLIGHTS 

NO. STATIC FIRED 

TYPE STATIC FIRING 

REDSTONE 

8/53 - 7/61 

75 

57 

FULL DURATION 

THOR 

1/57-9/64 

179 

14 

FULL DURATION 

JUPITER 

3/57 - 5/61 

39 

31 

FULL DURATION 

ATLAS 

6/57 - 9/64 

223 

38 

SHORT DURATION 

TITAN 1 

8/59 - 5/63 

55 

38 

SHORT DURATION 

TITAN II 

3/62- 11/64 

39 

12 

SHORT DURATION 

GEMINI 

4/64-11/66 

14 

0 

NONE 

TITAN III 

9/64 - 12/67 

23 

2 

SHORT DURATION 

SATURN I/IB 

11/61 - 10/68 

15 

15 

FULL DURATION 

SATURN V 

11/67- 

2 

2 

FULL DURATION 


RHSV000745.01 
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Table 2 

SUMMARY MILITARY MISSILE FLIGHTS 

(FROM 8/53 THROUGH 12/67) 
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be tested by static firing were specifically excluded from these data. 



Table 3 

SUMMARY OF FIRST TWENTY-FIVE FLIGHTS 
- yes, F = FLIGHT FAILURE*, SF = HAD STATIC FIRING OF SOME KIND 
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* Only those flight failures directly attributable to missile hardware systems which should have been caught by a full duration static firing. All failures resulted in 
destruction of the missile, either by itself or by Range Safety. Erroneous command destructs and failures attributable to missile systems not possible to be 
tested by static firing were specifically excluded from these data. 
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(4) Identified as the result of static firing operations which could have caused mission loss. 





Table 5 

FREQUENCY OF UNPLANNED STATIC FIRING EXPERIENCES 

BASIS: ALL SATURN STAGES EQUAL 


SEQUENTIAL 
SERIAL NO. 

NO. 

STAGES 

LAUNCH 

ABORT 

MISSION 

LOSS 

OTHER 

CRITICAL 

TOTAL 

(%) TOTAL 
NO. STAGES 

1 

6 


1 

4 

5 

83 

2 

6 

1 

2 


3 

50 

3 

6 


1 


1 

16 

4 

6 





0 

5 

6 



1 

1 

16 

6 

6 





0 

7 

3 





0 

8 

2 


1 

1 

2 

100 

9 

2 





0 

10 

2 

1 



1 

50 

11 

2 



1 

1 

50 

12 

2 

1 



1 

50 

13 

2 





0 

14 

2 

1 



1 

50 

15 

2 





0 

16 

2 





0 

17 

2 





0 

18 

1 


1 


1 

100 

19 

1 





0 

20 

1 





0 

21 

1 



1 

1 

100 

22 

1 





0 

TOTAL 

S 58 

4 

6 

8 

18 

31 
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TABLE 6 


S-l- 

S-1B 
S- ID 

S-1C 


LAUNCH ABORTS AVOIDED 


10 First static firing erroneously cut-off because of poor thrust 
OK switch setting. (DESIGN) 

-2 Same as S- 1-10 (DESIGN) 

-4 Hydraulic accumulator unable to maintain pressure because of inter- 
nal leakage. Had performed satisfactorily up to 10 minutes prior to 
ignition on first static firing countdown. (QC) 

-2 LOX pump seal purge regulator on stage failed during terminal count- 
down for first (and only) firing; required replacement before 
firing. (UNKNOWN) 
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TABLE 7 


MISSION LOSSES AVOIDED 

$-1-8 6 Engine turbine bearing retainer came loose during first short- 

duration firing damaging turbine, resulting in thrust decrease. 
(DESIGN) 

S-1B-8 18 Engine turbine blade failure during first short duration, caused 

severe damage to turbine and resulted in thrust decrease. 

Failure traced to improper turbine blade material used in building 
many engines already in field on other stages. (QC) 

S-IV-6 6 Engine gimbaled hard over at ignition. Failure traced to mani- 
fold in main hydraulic pump system that had not been drilled in 
manufacturing process. (QC) 

S-IVB-202 12 Firing 100 seconds short because fuel side propellant utilization 

probe indicated fuel zero right after ignition. Failure caused 
by loose wire (contamination) shorting out probe thus giving 
false reading. (QC) 

S-IVB-203 13 Fuel tank pressure collapse caused insufficient pressure to 

engine Inlet. Problem traced to design of pressurant diffuser. 
First experience with this small an ullage in this stage 
(DESIGN). 
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TABLE 8 


S- 1—5 


S-IVB-503 


S-IVB-205 


S-II-1 


S-II-1 


S-II-1 


OTHER CRITICAL FINDINGS 

Fifteen to twenty, fuel, hot gas and GOX leaks occurred in the 
closed boattail as the result of long duration firings. (QC + 
DESIGN) 

Destroyed by explosion during terminal countdown. If no static 
firing had been planned, this explosion possibly would have 
occurred on the Countdown Demonstration Test on the fully loaded 
Saturn V launch vehicle. The significance of such an occurrence 
is self-evident. (QC) 

LOX turbine wheel found cracked through all the way around at hub 
of wheel. While this wheel did not fail, there is a possibility 
that some subsequent wheel failure could have occurred. If this 
had happened in flight, not only would it have been hard to defi- 
nitely analyze, but it would have cost a mission and possibly 
lives, and many have recurred before a fix was found. (DESIGN) 

Ignition detection probe malfunctioned causing cut-off of one 
engine. This is a flight safety system. Failure was traced to 
improper assembly. (QC) 

High pressure LOX supply line to augmented spark igniter was 
found cracked after first firing. If that had happened in 
flight, a fire might have resulted and possibly mission loss. 
Failure caused redesign of this line. (DESIGN) 

An explosion occurred in the actuator of an engine main LOX 
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valve. Occurrence was traced to wrong grease used in valve 
build-up at factory. If not found in this manner, a more drastic 
experience might have happened in flight where the cause would 
have been very hard to determine. (QC) 

S-II-1 LOX pre-valve on center engine lacked proper clearance with LOX 

tank sump and center engine beam deflections. Pre-valve housing 
redesigned. In flight, interference due to acceleration could 
have caused loss of mission. (DESIGN) 

S-IB-11 LOX pump seal failure caused fire in engine compartment. Slow 

reaction of launch fire detection system would have allowed 
launch to proceed with this catastrophic condition. (DESIGN) 
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APPENDIX 11 


PROPULSION COMMUNITY QUESTIONNAIRE 


The questionnaire used to obtain the responses included in the body of this 
report is included herein for reference. 
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National Aeronautics and 
Soace Administration 


NASA 


John C. Stennis Space Center 

Stenms Soace Center. MS 39529-6000 


t,eo '* 'o o' FA00/08MLC01 


TO: 


Distribution 


FROM: FAOO/M. L. Carpenter 

SUBJECT: Request for Propulsion Systems Test Information 


New National Space Transportation System Vehicles are currently 
being planned. As the designated NASA propulsion test location, 
we feel it is imperative to examine lessons learned from previous 
propulsion system verification programs and to document your 
thoughts on propulsion system testing. 

First, we request that you jot down (handwritten is okay) 
propulsion system test incidents that led to a significant design 
or procedural change. We are after hard evidence that shows system 
testing paid off by revealing problems that would have led to loss 
of mission or loss of human life. 

Next, we request that you express your professional opinion on 
system verification requirements by circling the correct number of 
each trade criteria. This information will be used to attempt to 
quantify the subjective thinking of the propulsion community using 
the Analytical Hierarchy Process described by T. L. Saaty (McGraw 
Hill: NY, 1980). 

In addition, a written statement that summarizes your experience, 
knowledge, and judgement concerning system testing would be 
helpful . 


Your response to these requests will be incorporated into a study 
being performed by Rockwell's Space Division for this Center. Jim 
Yeager is leading the study effort to be completed in the March- 
April timeframe. Of course, you will be on distribution for a copy 
of the study report. 


Your response by February 21, 1989, will be greatly appreciated. 



Deputy director 
PropuTsion Test Operations 
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QUESTIONNAIRE 

PROPULSION SYSTEMS VERIFICATION REQUIREMENTS 

FOR 

ADVANCED PROPULSION SYSTEM 

1. Please list previous propulsion system test results (or failures) that led to significant 
design or procedural changes. (Test site, test article, date, test number, description of 
results or incidents, etc.) Please limit to Saturn, Titan, Shuttle or foreign country 
programs of this vintage. 


2. Please summarize your opinion of the role of "all-up" systems testing in verification of a 
new propulsion system prior to first launch. 


Name 


RHSV000386.01 
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3. Assign a numerical rating of one to nine to one criterion in each pair that you consider 
to be more important than the other one when you are planning a propulsion system 
verification program for an advanced propulsion system. The scale should be used to 
indicate how much more important than the other that you consider the criterion you 
selected to be. Please circle the number on the scale that indicates the rating you 
wish to assign the selected criterion. The first pair in the table has been marked as an 
example. 

For purposes of this questionnaire, the following definitions apply: 

Cost - The cost of performing the system testing and analysis. 

Reliability - The increased probability of propul n system success including the 
reduction in probability that the launch vehicle and its payload will be destroyed 
and/or the fleet grounded. 

Schedule - The impact on the schedule caused by the test program. 


MUCH SOMEWHAT SOMEWHAT 'MUCH 

MORE MORE MORE MORE MORE MORE 

IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT 
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4a. The criterion for this table is COST. Please select the one test plan alternative from 
each pair in the table that you consider to be the least costly. Circle the number on 
the scale that indicates how much less costly you consider the alternative you 
selected to be. The first pair of alternatives in the table has been marked as an 
example. 

For purposes of this questionnaire the following definitions apply for propulsion 
system components: 

Cost - The cost of performing the system testing and analysis. 

Analysis Only - Components are tested on individual basis and not as a system. 
System verification is by analysis. 

Battleship Test - Components are tested on individual basis and then installed for 
testing on heavyweight tanks in a flight system configuration. 

Flight Configuration Test Article - Components are tested on individual basis 
and then installed in an actual flight configuration test article for static firing tests. 

FRF Test Only - Components are tested on an individual basis then installed on a 
flight vehicle which is checked out in a short duration static firing on the launch 
pad. 

Flight Test - Components are tested on an individual basis, then installed in a 
launch vehicle and launched on a test flight. 

CRITERION = COST 

MUCH SOMEWHAT SOMEWHAT MUCH 

MORE MORE MORE MORE MORE MORE 

PREFERRED PREFERRED PREFERRED PREFERRED PREFERRED PREFERRED 

P 

ANALYSIS ONLY EXAMPLE ESHIP TEST PLUS ANALYSIS 

9 8 7 6 5 ( 4 ) 3 2 123456 78 9 


ANALYSIS ONLY 

BATTLESHIP TEST PLUS ANALYSIS 

987654321 2345678 9 


ANALYSIS ONLY 

FLIGHT CONFIGURATION TEST ARTICLE 
PLUS ANALYSIS 

98 7654321 

2 3 4 5 6 7 8 9 


ANALYSIS ONLY 

FRF TEST ONLY PLUS ANALYSIS 

987654321 

2345678 9 


RHSV000386 
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CRITERION = COST 


MUCH 

MORE 

PREFERRED 


MORE 

PREFERRED 


ANALYSIS ONLY 


SOMEWHAT SOMEWHAT MUCH 

MORE MORE MORE MORE 

PREFERRED PREFERRED PREFERRED PREFERRED 


FLIGHT TEST PLUS ANALYSIS 


9 8 


6 5 


2 3 


BA TTLESHIP TEST PLUS ANAL YSIS FLIGHT CONFIGURA TION TEST ARTICLE 

PLUS ANALYSIS 


1 2 3 


BA TTLESHIP TEST PLUS ANAL YSIS FRF TEST ONL Y PLUS ANAL YSIS 


1 2 3 


8 9 


BATTLESHIP TEST PLUS ANALYSIS 


FLIGHT TEST PLUS ANALYSIS 


1 2 3 


5 6 


8 9 


FLIGHT CONFIGURATION TEST ARTICLE 
PLUS ANALYSIS 


9 8 


FRF TEST ONLY PLUS ANALYSIS 


FLIGHT CONFIGURATION TEST ARTICLE 
PLUS ANALYSIS 


FLIGHT TEST PLUS ANALYSIS 


8 9 


FRF TEST ONLY PLUS ANALYSIS 


FLIGHT TEST PLUS ANALYSIS 
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4b. The criterion for this table is RELIABILITY. Please select the one test plan alternative 
from each pair in the table that you consider to result in the most reliable propulsion 
system. Circle the number on the scale that indicates how much more reliability you 
consider the alternative you selected will provide. The first pair of alternatives in the 
table has been marked as an example. 

For purposes of this questionnaire the following definitions apply for propulsion 
system components: 

Reliability - The increased probability of propulsion system success including the 
reduction in probability that the launch vehicle and its payload will be destroyed 
and/or the fleet grounded. 

Analysis Only - Components are tested on individual basis and not as a system. 
System verification is by analysis. 

Battleship Test - Components are tested on individual basis and then installed for 
testing on heavyweight tanks in a flight system configuration. 

Flight Configuration Test Article - Components are tested on individual basis 
and then installed in an actual flight configuration test article for static firing tests. 

FRF Test Only - Components are tested on an individual basis then installed on a 
flight vehicle which is checked out in a short duration static firing on the launch 
pad. 

Flight Test - Components are tested on an individual basis, then installed in a 
launch vehicle and launched on a test flight. 

CRITERION = RELIABILITY 


MUCH SOMEWHAT SOMEWHAT MUCH 

MORE MORE MORE MORE MORE MORE 

PREFERRED PREFERRED PREFERRED PREFERRED PREFERRED PREFERRED 

, — 

ANALYSIS ONLY EXAMPLE ESHIP TEST PLUS ANALYSIS 


9 8 7 6 5 (4) 3 2 1 2 3 4 5 6 7 8 9 


ANALYSIS ONLY 

BATTLESHIP TEST PLUS ANALYSIS 

987654321 2345678 9 


ANALYSIS ONLY 

FLIGHT CONFIGURATION TEST ARTICLE 
PLUS ANALYSIS 

987654321 2345678 9 


ANALYSIS ONLY 

FRF TEST ONLY PLUS ANALYSIS 

IH 

8 

7 6 5 4 3 

2 1 

2345678 9 
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CRITERION = RELIABILITY 


MUCH 

MORE 

PREFERRED 


MORE 

PREFERRED 


ANALYSIS ONLY 


SOMEWHAT 

MORE 

PREFERRED 


SOMEWHAT 

uryx 

PREFERRED 


MORE 

PREFERRED 


MUCH 

MORE 

PREFERRED 


FLIGHT TEST PLUS ANALYSIS 


9 8 


2 3 


BATTLESHIP TEST PLUS ANALYSIS FU ^HT ART,CLE 

rLUo r\Nr\LY 0/0 


1 2 3 


8 9 


BA TTLESHIP TEST PLUS ANAL YSIS FRF TEST ONL Y PLUS ANAL YSIS 


9 8 


6 5 


1 2 3 


8 9 


BATTLESHIP TEST PLUS ANALYSIS FLIGHT TEST PLUS ANALYSIS 


1 2 3 


FLIGHT CONFIGURA TION TEST ARTICLE FRF TEST QNL y pLUS ysiS 

PLUS ANALYSIS 


6 5 


1 2 3 


8 9 


FLIGHT CONFIGURA TION TEST ARTICLE FLIGHT TEST PLUS ANAL YSIS 

PLUS ANALYSIS 


6 5 


1 2 3 


5 6 7 8 9 


FRF TEST ONLY PLUS ANALYSIS FLIGHT TEST PLUS ANALYSIS 
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4c. The criterion for this table is SCHEDULE. Please select the one test plan alternative 
from each pair in the table that you consider to cause the least schedule impact. 
Circle the number on the scale that indicates how much less schedule impact you 
consider the alternative you selected to have. The first pair of alternatives in the table 
has been marked as an example. 

For purposes of this questionnaire the following definitions apply for propulsion 
system components: 

Schedule - The impact on the schedule caused by the test program. 

Analysis Only - Components are tested on individual basis and not as a system. 
System verification is by analysis. 

Battleship Test - Components are tested on individual basis and then installed for 
testing on heavyweight tanks in a flight system configuration. 

Flight Configuration Test Article - Components are tested on individual basis 
and then installed in an actual flight configuration test article for static firing tests. 

FRF Test Only - Components are tested on an individual basis then installed on a 
flight vehicle which is checked out in a short duration static firing on the launch 
pad. 

Flight Test - Components are tested on an individual basis, then installed in a 
launch vehicle and launched on a test flight. 

CRITERION = SCHEDULE 

MUCH SOMEWHAT- SOMEWHAT MUCH 

MORE MORE MORE MORE MORE MORE 

PREFERRED PREFERRED PREFERRED PREFERRED PREFERRED PREFERRED 

1 

ANALYSIS ONLY EXAMPLE ESHIP TEST PLUS ANALYSIS 

9 8 7 6 5 (4) 32 12345678 9 


ANALYSIS ONLY 

BATTLESHIP TEST PLUS ANALYSIS 

987654321 2345678 9 


ANALYSIS ONLY 

FLIGHT CONFIGURATION TEST ARTICLE 
PLUS ANALYSIS 

987654321 2345678 9 


ANALYSIS ONLY 

FRF TEST ONLY PLUS ANALYSIS 

1 9 

8 

7 6 5 4 3 

2 1 

2345678 9 





RHSV000386 




11 

RHSV000386 01 

-9 



















CRITERION = SCHEDULE 


MUCH SOMEWHAT 

MORE MORE MORE 

PREFERRED PREFERRED PREFERRED 


ANALYSIS ONLY 


SOMEWHAT 

UODC 

PREFERRED 


MORE 

PREFERRED 


MUCH 

MORE 

PREFERRED 


FLIGHT TEST PLUS ANALYSIS 


2 3 


BA TTLESHIP TEST PLUS ANAL YSIS FUGHT CONFIGURA TION TEST ARTICLE 

PLUS ANALYSIS 


9 8 


6 5 


1 2 3 


BATTLESHIP TEST PLUS ANALYSIS FRF TEST ONLY PLUS ANALYSIS 


8 9 


BATTLESHIP TEST PLUS ANALYSIS 


FLIGHT TEST PLUS ANALYSIS 


1 2 3 


8 9 


FLIGHT CONFIGURATION TEST ARTICLE 
PLUS ANALYSIS 


FRF TEST ONLY PLUS ANALYSIS 


1 2 3 


FLIGHT CONFIGURATION TEST ARTICLE 


PLUS ANALYSIS 


9 8 


FLIGHT TEST PLUS ANALYSIS 


1 2 3 


8 9 


FRF TEST ONLY PLUS ANALYSIS 


FLIGHT TEST PLUS ANALYSIS 
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